Multi-factor Password-authenticated Key Exchange Protocol
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer authentication technologies are vulnerable to phishing and spyware attacks, as they rely on single-factor password authentication that can be easily compromised, especially when used on infected devices, and do not protect authentication secrets during the authentication process.
Innovation Solution
A multi-factor password-authenticated key exchange protocol that uses both a long-term user-memorized password and a dynamic one-time response value, where the server system verifies the client's access to these secrets without exposing them, ensuring strong two-factor authentication and secure session key establishment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single-factor password authentication is used, then ease of operation is improved, but security is worsened due to vulnerability to phishing and spyware attacks
Solution Approach 1:
The authentication process is segmented into multiple independent factors: something the user knows (password) and something the user has (one-time response). This segmentation ensures that compromise of one factor does not compromise overall authentication security, resolving the contradiction between ease of operation and security.
Solution Approach 2:
The system uses dynamic one-time response values that change with each authentication attempt, replacing static passwords with evolving authentication elements. This dynamic approach maintains user convenience while significantly improving security against replay attacks and spyware.
2Ease of operation
If long-term passwords are used for authentication, then ease of operation is improved, but security is worsened because passwords can be captured and misused by spyware
Solution Approach 1:
The system replaces durable long-term passwords with short-lived one-time response values that are valid only for a single authentication attempt. These disposable credentials cannot be reused by spyware or malicious software, eliminating the risk of long-term password capture while maintaining ease of use.
Solution Approach 2:
The system prepares and provides one-time response values in advance through secure channels, cushioning against the risk of spyware capture. By obtaining authentication credentials before the potential compromise event, the system ensures that even if spyware is present, it cannot capture usable authentication information.
3Reliability
If multi-factor authentication is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The system merges multiple authentication factors (password and one-time response) into a unified protocol that handles both factors through a single integrated process. This combining approach achieves multi-factor security without requiring separate complex authentication flows, thereby limiting the increase in device complexity.
Solution Approach 2:
The patent introduces an intermediary authentication framework that coordinates between different authentication factors and systems. This mediator approach simplifies the interaction between multiple factors, reducing the complexity burden on individual devices while maintaining strong security.
4Ease of operation
If authentication secrets are exposed during the authentication process, then ease of operation is improved, but security is worsened due to vulnerability to man-in-the-middle attacks
Solution Approach 1:
The system replaces direct mechanical transmission of authentication secrets with cryptographic substitution. Instead of exposing secrets in plaintext, the protocol uses encrypted exchanges and challenge-response mechanisms where authentication information is transformed into secure mathematical operations, eliminating man-in-the-middle vulnerability while maintaining operational ease.
Solution Approach 2:
The authentication process skips the vulnerable intermediate step of secret exposure by implementing a challenge-response protocol. The client and server rush through cryptographic verification without ever transmitting raw authentication secrets, preventing man-in-the-middle attacks while keeping the process simple for users.
Data Source
AI summary
Apparatus, methods, and computer program products are disclosed that enable a first computer and a second computer to mutually authenticate each other over a network. A first computer sends first authentication evidence to a second computer. The first authentication evidence is used to prove to the second computer that the first computer has access to a first plurality of authentication secrets without exposing the first plurality of authentication secrets. In addition, the second computer sends second authentication evidence to the first computer. The second authentication evidence is used to prove to the first computer that the second computer has access to a second plurality of authentication secrets without exposing the second plurality of authentication secrets. The first plurality of authentication secrets is related to the second plurality of authentication secrets. Thus, the first computer is authenticated to the second computer and the second computer is authenticated to the first computer.