Hash Chain Intermediate Values for Secure Storage Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems using one-time passcode devices face vulnerabilities, particularly the 'break once, run anywhere' issue where compromising one storage array's key can access all others sharing the same key, compromising security.
Innovation Solution
The use of intermediate values from a hash chain as access credentials, where each value is hashed a specific number of times based on the access control interval, ensuring that only the final value grants access, and isolating the initial value to prevent key compromise from affecting other arrays.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single key is replicated on multiple storage arrays to enable service technician access control, then the ease of operation is improved (service technicians need to keep track of fewer passcodes), but the security is worsened (an attacker who compromises one storage array can access all others sharing the same key)
Solution Approach 1:
The patent divides the single key into multiple independent hash chain keys, with each storage array receiving a unique key. This segmentation eliminates the 'break once, run anywhere' vulnerability while maintaining ease of operation, as service technicians receive a single passcode that works across all arrays without compromising security between arrays.
Solution Approach 2:
The patent introduces hash chains as an intermediary mechanism between the key and the passcode generation process. Each key generates a hash chain where intermediate values serve as passcodes. This intermediary structure allows secure key isolation while enabling centralized passcode management for service technicians.
2Device complexity
If conventional authentication tokens are used with static passwords, then the device complexity is reduced (simple authentication mechanism), but the security is worsened (vulnerable to replay attacks and lack of dynamic protection)
Solution Approach 1:
The patent transforms static password authentication into dynamic authentication using hash chains. Each authentication instance uses a unique intermediate value from the hash chain, making credentials dynamic and time-limited. This maintains relatively simple device complexity while dramatically improving security reliability by preventing replay attacks.
3Reliability
If hash chain intermediate values are used as access credentials with different hashing iterations for different intervals, then the security is improved (isolated key compromise), but the device complexity increases (complex hash chain management and verification)
Solution Approach 1:
The patent performs preliminary actions by pre-generating hash chains and storing only the final values in the authentication system. Intermediate values are generated on-demand during authentication intervals. This preliminary preparation reduces runtime complexity while maintaining strong security through isolated key compromise.
Data Source
AI summary
A processing device comprises a processor coupled to a memory and is configured to obtain an intermediate value of a hash chain associated with a given access control interval, to utilize at least a portion of the intermediate value to access a protected resource during the given access control interval, and to repeat the obtaining and utilizing for one or more additional access control intervals using respective different intermediate values of the hash chain. The hash chain may comprise one of a plurality of hash chains derived from a common key, where the plurality of hash chains are associated with corresponding distinct resources and initial values of the plurality of hash chains are determined as respective functions of the common key and identifying information for corresponding ones of the protected resources.