Distributed Kerberos Authentication via Private Key Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Kerberos authentication protocols are vulnerable to breaches of the Key Distribution Center (KDC), which can compromise user passwords, and lack support for distributed password verification, making them insecure for distributed environments.
Innovation Solution
Modifying the PKINIT protocol extension to Kerberos to enable distributed password-based authentication by using a plurality of servers storing private key shares and a controller to perform authentication based on encrypted passwords, formatted within a public key cryptography framework.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the KDC stores digests of user passwords for verification, then authentication can be performed, but breach of the KDC reveals user passwords and compromises all user credentials
Solution Approach 1:
The patent divides the password verification function into two separate components: a password hash generator that creates password hashes, and a password hash verifier that verifies passwords against stored hashes. This segmentation ensures that the KDC stores only password hashes而非 plaintext passwords, so that even if the KDC is breached, attackers cannot directly obtain usable passwords. The segmentation resolves the contradiction by maintaining authentication functionality while eliminating the security vulnerability of storing plaintext passwords.
2Adaptability or versatility
If the KDC verifies ciphertext encrypted under a password-derived key, then password-based authentication is supported, but explicit access to the password or derived key is required
Solution Approach 1:
The patent introduces an intermediary component called the password hash generator that acts as a mediator between the client and the KDC. This generator creates password hashes locally and sends only the hashes to the KDC for storage and verification. The intermediary eliminates the need for the KDC to have explicit access to plaintext passwords or derived keys, while still enabling password-based authentication. This resolves the contradiction by adding a mediating layer that simplifies the overall system architecture.
3Reliability
If Kerberos protocol is modified to support distributed password verification, then security is improved, but the protocol complexity increases
Solution Approach 1:
The patent designs the password hash generator and verifier as universal components that can work with multiple authentication protocols and password hashing algorithms. The generator can create hashes using different algorithms (e.g., SHA-256, bcrypt), and the verifier can check against various hash formats. This universality allows the distributed password verification system to be integrated into existing Kerberos infrastructure without requiring protocol-specific customizations for each hashing algorithm, thereby reducing overall system complexity while maintaining enhanced security.
Data Source
AI summary
An authentication system comprises a plurality of servers storing respective shares of a private key, and a controller associated with the servers. The authentication system is configured to receive a message comprising a password encrypted using a public key corresponding to the private key. The controller directs performance of distributed password-based authentication in the authentication system based at least in part on the encrypted password utilizing the shares of the private key stored in the respective servers. The message is formatted in a manner consistent with an authentication protocol that normally utilizes public key signatures as a mechanism for authentication but is modified to support password-based authentication. For example, the message may be formatted in a manner consistent with a request message of a Kerberos PKINIT protocol extension.