Login Executable Hash Verification for Secure Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing device login authentication methods are vulnerable to reverse-engineering and attacks, allowing unauthorized access by malicious actors, particularly when software updates occur.
Innovation Solution
Implementing a pre-authentication security check using a controller to verify hash values of login executable code and user credentials before allowing access to the operating system, ensuring secure data communication and storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional software-based authentication is used, then ease of operation is improved, but device security deteriorates due to vulnerability to reverse-engineering and attacks
Solution Approach 1:
The authentication system is segmented into two independent parts: a traditional software-based authentication layer for ease of operation, and a separate hardware-based authentication layer (using a security controller or TPM) for enhanced security. The hardware controller stores cryptographic credentials and performs independent verification, so the software layer can remain user-friendly while the hardware layer provides security against reverse-engineering and attacks.
2Reliability
If pre-authentication security checks are added, then device security is improved, but device complexity increases due to additional hardware controller
Solution Approach 1:
A dedicated security controller or TPM (Trusted Platform Module) is introduced as an intermediary component between the user and the operating system. This intermediary handles all cryptographic operations and credential verification, allowing the main system to remain relatively simple while the intermediary provides robust security checks before authentication is granted.
3Object-affected harmful factors
If hash value verification is implemented, then resistance to attacks is improved, but processing time increases during login
Solution Approach 1:
Cryptographic hash values of credentials are pre-computed and stored in the hardware security controller during system initialization or credential creation. During login, the controller directly compares the provided credential's hash against the pre-stored hash values using efficient hardware-based comparison circuits, avoiding time-consuming cryptographic operations during the actual authentication moment.
Data Source
AI summary
Examples include a CPU coupled to a controller, the CPU to receive a user credential usable by the login executable code to perform device login authentication, determine a first hash value based on the login executable code, determine a second hash value based on the user credential, obtain a third hash value and a fourth hash value from the controller, wherein the third hash value is a reference hash value for the login executable code, and wherein the fourth hash value is a reference hash value for the user credential, compare the first hash value to the third hash value, compare the second hash value to the fourth hash value, execute an OS login service using the login executable code responsive to the first hash value matching the third hash value and the second hash value matching the fourth hash value.