Key Handle Password Authentication Against Hash-Based Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password authentication systems are vulnerable to attacks by sophisticated actors due to the potential exposure of actual passwords and the inefficiency of salt-based security measures, which can be compromised with significant computing power.
Innovation Solution
Implementing a cryptographic key handle-based authentication system where a key handle references a cryptographic key stored securely within a security processor, using a keyed-hash algorithm to derive a reference hash, preventing the exposure of the underlying password and enhancing security against dictionary and rainbow table-based attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional salt-based password hashing is used, then password verification can be performed, but the system remains vulnerable to dictionary and rainbow table attacks with significant computing power
Solution Approach 1:
The patent introduces a cryptographic key handle as an intermediary between the password and the authentication verification process. Instead of directly storing or comparing password hashes, the system uses the key handle to reference a cryptographic key that is securely stored within the security processor. This intermediary layer prevents direct exposure of password-derived values and blocks traditional attack vectors like dictionary and rainbow table attacks, as the key handle alone cannot be used to derive the actual password or its hash.
2Ease of operation
If actual passwords are stored for authentication, then verification is straightforward, but the system becomes vulnerable to exposure and unauthorized access
Solution Approach 1:
The patent extracts the sensitive password information from the authentication record and stores it exclusively within the security processor. The authentication record contains only a key handle, which is a non-sensitive reference to the cryptographic key. This extraction separates the confidential password material from the accessible authentication data, eliminating the risk of password exposure through authentication record compromise while maintaining efficient verification through the key handle mechanism.
3Ease of operation
If cryptographic keys are stored externally for password verification, then access is simplified, but security against unauthorized access is reduced
Solution Approach 1:
The patent implements a nested structure where the cryptographic key is contained within the security processor, and the key handle serves as a reference layer that points to the nested key. This nesting allows the system to maintain simple key access through the handle while preserving the security of the actual cryptographic key within the protected security processor boundary. The key handle provides ease of operation by serving as a simple identifier, while the nested key within the security processor ensures cryptographic security.
Data Source
AI summary
A process includes receiving credentials associated with a request to access a computer platform. The credentials include a password and a user identification. The process includes determining a key handle and a reference cryptographic digest corresponding to the user identification. The process includes determining a second cryptographic digest corresponding to the user identification. Determining the second cryptographic digest includes providing the key handle and the password to a security processor of the computer platform and initiating an operation by the security processor to apply a keyed-hashing function to the password based on a cryptographic key corresponding to the key handle to provide the second cryptographic digest. The security processor stores the cryptographic key. The process includes regulating access to the computer platform based on a comparison of the second cryptographic digest to the reference cryptographic digest.