Multi-Factor Encryption Key Generation from Simple Password
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems face challenges such as the vulnerability of static passwords, the need for additional hardware tokens, and the inconvenience of managing multiple passwords, as well as the risk of unauthorized access due to stolen devices and insecure storage of PINs/Passwords.
Innovation Solution
A method and system for generating a multi-factor encryption key using a simple password, which involves computing a shared secret key from a device-specific ID and a random number, and using this to create a Masked One Time Password (MOTP) for secure authentication and encryption, without storing the password on the client or server, thus providing a secure and convenient authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a simple password is used for authentication, then ease of operation is improved, but security is worsened
Solution Approach 1:
The authentication system is segmented into multiple independent components: a simple user password, a device-specific identifier, and a server-generated random number. These segments are combined through cryptographic operations to produce a strong encryption key, allowing the system to maintain operational simplicity while achieving high security through compositional strength.
Solution Approach 2:
The patent creates a composite authentication mechanism by combining three distinct elements (user password, device ID, server random number) into a unified encryption key. This composite approach ensures that compromising any single element does not compromise the overall security, resolving the contradiction between simple authentication and strong security.
2Reliability
If a hard token is used for two-factor authentication, then security is improved, but device complexity and ease of operation are worsened
Solution Approach 1:
The patent replaces the mechanical hard token system with a software-based cryptographic solution. Instead of requiring physical devices to generate and store secret keys, the system uses software to perform cryptographic operations on the client side, combining the user password with device-specific identifiers to generate authentication credentials without any additional hardware.
Solution Approach 2:
The client device performs self-service authentication by generating its own cryptographic credentials using its unique device identifier and the user's password. The device autonomously creates the encryption key and authentication tokens without requiring external hardware tokens or additional security devices, eliminating the need for hard tokens while maintaining strong security.
3Ease of operation
If a PIN/password is stored on the user device, then ease of operation is improved, but security is worsened due to potential theft or unauthorized access
Solution Approach 1:
The patent extracts the password from storage on both the client device and server. Instead of storing the password in any location, the system uses the password only during the authentication process to generate cryptographic keys. The password is immediately discarded after use, eliminating the security risk associated with stored credentials while maintaining operational convenience.
Solution Approach 2:
The patent introduces cryptographic key derivation as an intermediary process between the password and the authentication system. The password serves only as input to generate a derived encryption key, which then mediates all authentication operations. This intermediary approach ensures the password itself never needs to be stored or transmitted, protecting against unauthorized access while maintaining ease of operation.
4Device complexity
If the same server key is used to encrypt all customers' data, then device complexity is reduced, but security is worsened due to key compromise affecting all customers
Solution Approach 1:
The patent implements local quality in encryption key management by generating unique encryption keys for each individual customer rather than using a single shared key. Each customer's encryption key is locally derived from their unique password and device identifier combination, ensuring that security properties are customized and isolated for each user. This approach increases key management complexity slightly but provides superior security where compromise of one key does not affect other customers.
Data Source
AI summary
The present invention relates to a method of generating a multi-factor encryption key using a simple password in order to access control over information stored at a second entity from a first entity via at least one communication network. In one embodiment this is accomplished by, requesting to receive an application at the first entity from the second entity via the communication network, activating the first entity to generate a shared secret key, wherein the shared secret key is computed from a first entity specific ID and a random number generated at the first and second entity and allowing the user to register with the application of the second entity by the first entity, wherein the registration include entry of a personal PIN (personal identification number), a personal message etc.