Matrix Pattern Authentication Using Slow Hashing and Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Matrix Pattern Authentication (MPA) systems face significant processing overhead due to the need to generate and compare multiple possible combinations of memorable identification patterns, making them inefficient in multi-user environments and vulnerable to brute force attacks, especially when using strong encoding algorithms like SHA-2.
Innovation Solution
The implementation of a method that uses large square matrices with increased entropy, such as a 36-element (6x6) array, and incorporates a two-factor or three-factor authentication system, including biometric data, to enhance security and reduce processing time by employing a slow hashing algorithm like PBKDF2 and a strong two-way transcoding algorithm like AES256, while ensuring the challenge code is unique and difficult to guess.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional MPA systems use strong encoding algorithms like SHA-2 to secure authentication codes, then security against brute force attacks is improved, but processing time increases significantly
Solution Approach 1:
The patent changes the parameter of hashing algorithm from fast algorithms (SHA-2) to slow algorithms (PBKDF2, scrypt, Argon2), which intentionally increases processing time to make brute force attacks computationally expensive. This parameter change directly addresses the contradiction by sacrificing speed to enhance security.
Solution Approach 2:
The system performs preliminary actions by storing the authentication code in a challenge-response format where the challenge is pre-generated and the response is pre-computed. This allows the slow hashing to be done in advance during registration rather than during authentication, reducing the impact on user experience while maintaining security.
2Reliability
If MPA systems generate multiple possible combinations of memorable identification patterns to prevent guessing, then security is improved, but processing overhead increases
Solution Approach 1:
The patent extracts the authentication code from the challenge-response pair and stores it separately in a secure location. This allows the system to verify the authentication code independently without needing to generate and compare multiple combinations, thereby reducing processing overhead while maintaining security through the challenge-response mechanism.
Solution Approach 2:
The challenge-response pair acts as an intermediary between the user's memorable identification pattern and the stored authentication code. This intermediary allows the system to verify authentication without directly comparing multiple pattern combinations, reducing computational complexity while maintaining security.
3Reliability
If MPA systems use large square matrices with increased entropy to reduce guessing probability, then security is improved, but device complexity increases
Solution Approach 1:
The patent segments the authentication process into two independent parts: the challenge matrix display and the authentication code verification. This segmentation allows the system to use large matrices for high entropy while keeping the verification process simple and efficient, as the authentication code is verified directly without needing to re-generate the entire matrix configuration.
Data Source
AI summary
A method of encoding and/or decoding data is described, having the steps of: generating a challenge code, the challenge code being based on a pattern associated with at least one challenge arrangement having duplicated signs, encrypting the challenge code using a one-way hashing function to obtain a temporary encryption key, generating encoded data by encoding the data using a two-way transcoding function using the obtained temporary encryption key, wherein data is decoded using the two-way transcoding function and a subsequently obtained user temporary encryption key when the subsequently obtained user temporary encryption key matches the previously obtained temporary encryption key used to encode the data.