Hash Synchronization for Password Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based authentication systems are vulnerable to unauthorized access due to the inability of hashing mechanisms to protect against 'over the shoulder' snooping and keystroke logging attacks, as stolen plain text passwords can be used across different devices with the same hashing function.
Innovation Solution
Implementing hash synchronization between client and server devices, where an ordered set of hash functions is synchronized across both systems, ensuring that only authorized devices can use the correct hash function for password validation, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If password hashing is used to prevent network sniffing attacks, then network security is improved, but the system becomes vulnerable to shoulder-snooping and keystroke logging attacks
Solution Approach 1:
The authentication system segments the password verification process into multiple components: the password itself, the hash function selection, and the hashing operation. By synchronizing the hash function selection between client and server, the system creates a segmented defense where even if the password is stolen, the attacker cannot complete the authentication without the correct hash function sequence
Solution Approach 2:
The system performs preliminary action by pre-synchronizing the hash function sequence between the client device and server before authentication occurs. This preliminary synchronization ensures that when authentication is needed, both parties are already aligned on which hash function to use, preventing attackers from using stolen passwords with incorrect hash functions
2Ease of operation
If a single hash function is used for password validation, then the authentication process is simple, but stolen passwords can be used from any device
Solution Approach 1:
The system introduces dynamics by making the hash function selection change over time through synchronization. Instead of a static single hash function, the client and server dynamically select hash functions from an ordered set based on a synchronized counter, creating a time-varying authentication mechanism that remains simple to operate but secure against stolen password attacks
Solution Approach 2:
The system changes the parameter of hash function selection from a fixed single function to a dynamic selection from an ordered set. The synchronized counter acts as a parameter that both client and server use to select which hash function to apply, transforming the authentication process into a parameter-driven system that maintains simplicity while enhancing security
3Reliability
If multiple hash functions are synchronized between client and server, then security against stolen passwords is improved, but system complexity increases
Solution Approach 1:
The synchronization mechanism serves multiple functions: it selects hash functions, maintains security state, and enables authentication. This multi-functionality reduces overall system complexity by consolidating what could be separate complex mechanisms into a single universal synchronization protocol that handles hash function selection and security state management
Data Source
AI summary
Techniques for preventing unauthorized access to a server system using stolen passwords are provided. In one embodiment, the server system can store an ordered set of hash values for a user, where each hash value in the ordered set of hash values is generated by applying a hash function in an ordered set of hash functions to the user's password. The server system can further receive, from a client device, a login request for the user that includes a hashed version of the password, and can select a hash value in the ordered set of hash values using a server-side index that is synchronized with a client-side index on the client device. The server system can then grant the login request if the selected hash value matches the hashed version of the password.