Homomorphic Encryption User Authentication Without Password Disclosure

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing user authentication methods, such as password authentication and multi-factor authentication, are vulnerable to leaks and attacks, and homomorphic encryption is needed to secure communication without decrypting encrypted data.

Innovation Solution

An electronic device performs user authentication using homomorphic encryption by encrypting user identification and authentication information, allowing operations on encrypted data without decryption, and a server authenticates users based on nonce-generated authentication values.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional password authentication is used, then user authentication can be performed, but authentication information may be leaked and attacked

Engineering Contradiction:

Improveauthentication securityVSAvoidinformation leakage risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The authentication system is segmented into multiple components: the client device performs local encryption and authentication operations, while the server stores only encrypted authentication values. This segmentation ensures that even if the server is compromised, the actual password plaintext remains secure on the client side.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Homomorphic encryption serves as an intermediary mechanism that allows the server to perform authentication verification without ever accessing the plaintext password. The encrypted authentication values act as intermediaries that preserve security while enabling server-side verification.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If homomorphic encryption is used for authentication, then security is enhanced, but computational complexity increases

Engineering Contradiction:

Improveauthentication securityVSAvoidencryption operation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The homomorphic encryption keys are generated and stored in advance on the client device. The authentication logic and encrypted values are prepared beforehand, reducing the computational burden during the actual authentication process. This preliminary setup allows for faster, more efficient authentication operations.

Inventive Principle:

Principle #10Preliminary action

3Ease of operation

If password plaintext is stored on server, then authentication verification is simplified, but security is compromised

Engineering Contradiction:

Improveauthentication verificationVSAvoidcredential stuffing attack

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

Instead of storing the actual password plaintext, the server stores an encrypted copy (homomorphic encryption value) that can be used for verification purposes. This copied encrypted form maintains the ability to verify authentication while eliminating the security risks of plaintext storage.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The homomorphic encryption system acts as an intermediary layer between the client's password and the server's verification process. The server operates on encrypted values without ever needing to access or store plaintext passwords, thus preventing credential stuffing attacks while maintaining verification capability.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12413415B2Electronic device that performs user authentication using homomorphic encryption and control method thereof

Publication Date: 2025.09.09 CRYPTO LAB INC

AI summary

Disclosed are an electronic device and a control method thereof. The electronic device includes: a communication device; a memory configured to store an encryption key and a decryption key for performing homomorphic encryption; and a processor configured to be connected to the memory to control the electronic device, in which the processor is configured to: based on user's identification information and a first password being input to register the user's identification information and the first password, acquire a hash value using the first password, encrypt the hash value using the encryption key, transmit the identification information and the encrypted hash value to a server through the communication device, based on the identification information and a second password being input to log in to the server, load the encryption key and the decryption key and transmit the identification information to the server through the communication device, based on a first nonce being received from the server, acquire a first authentication value using the decryption key, the second password, and the first nonce and transmit the first authentication value to the server through the communication device, and based on a second authentication value being received from the server, decrypt the second authentication value, which is generated using the first authentication value and a second nonce, using the decryption key to acquire a third authentication value and transmit the third authentication value to the server through the communication device. In this case, the server authenticates the user using the third authentication value.