Hardware-Backed Password Verification for Multi-Tenant Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud systems face challenges in securely storing and managing user passwords due to the computational expense and vulnerability of hashing algorithms, which can be overcome by implementing hardware-backed encryption to protect passwords from theft and cracking.
Innovation Solution
The use of hardware-based encryption, specifically AES-GCM-256, to encrypt hash values of user passwords, ensuring they are stored securely and resistant to decryption by attackers, while allowing for seamless transitions between encryption schemes without requiring user credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hashing techniques are used to securely store passwords, then password security is improved, but computational expense increases and security becomes vulnerable to cracking as hashing algorithms are surpassed by CPU and GPU technology
Solution Approach 1:
The patent replaces software-based hashing algorithms with hardware-based encryption using dedicated encryption hardware (such as HSMs or smart cards). This substitution moves the cryptographic operations from general-purpose CPU/GPU to specialized hardware that is more resistant to cracking, directly addressing the vulnerability to password cracking while maintaining security
Solution Approach 2:
The patent introduces a hardware security module as an intermediary between the password storage system and the verification process. This intermediary component handles the encryption and decryption operations securely, preventing direct exposure of password hashes to the computational attacks that would occur with traditional software-based hashing
2Reliability
If hardware-based encryption with symmetric key wrapped by asymmetric public key is implemented, then security and resilience are enhanced, but device complexity increases
Solution Approach 1:
The patent implements a nested key management structure where a symmetric encryption key is wrapped (encrypted) using an asymmetric public key. This nested approach allows the system to leverage both the efficiency of symmetric encryption and the key distribution advantages of asymmetric encryption, while the asymmetric key serves as a protective layer for the symmetric key
Solution Approach 2:
The asymmetric public key serves multiple functions: it encrypts the symmetric key for secure storage, and it can also be used for digital signatures and authentication. This multi-functionality reduces the need for separate key pairs and simplifies the overall system architecture despite the added complexity of hardware-based encryption
3Ease of operation
If traditional hashing algorithms are used for password storage, then ease of operation is maintained, but productivity decreases due to computational expense and time-consuming security updates
Solution Approach 1:
The patent performs preliminary encryption of passwords using hardware-based encryption during the initial password setup process. The encrypted passwords are then stored in the database, and when updates are needed, the system can efficiently re-encrypt using updated hardware algorithms without requiring re-hash computation, thus improving productivity while maintaining ease of operation
Data Source
AI summary
Methods, systems, and devices for data processing are described. A server host may receive a login request that includes a clear text password for an account associated with a tenant of a multi-tenant cloud platform. The server host may retrieve an encrypted payload associated with the account. The encrypted payload may include a hash value of a user-configured password for the account and an indication of a hashing algorithm used to transform the user-configured password into the hash value. The server host may obtain a wrapped symmetric key provisioned by a symmetric key distribution service. The server host may transmit a request that includes the encrypted payload, the clear text password, and the wrapped symmetric key. The server host may receive a response that indicates whether a hash value of the clear text password from the login request corresponds to the hash value of the user-configured password.