Multi-factor Protected Private Key Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer network authentication schemes face challenges in providing efficient, inexpensive, and low processing-cost methods for reliable and attack-resistant authentication of users and entities seeking access to resources or applications, especially in mobile user settings where managing and backing up Public Key Infrastructure (PKI) private keys can be cumbersome.
Innovation Solution
The implementation of multi-factor protected private key distribution (MFPPKD) methods, which involve computing cryptographically secure hashes and a location reference from user inputs like usernames, passwords, and device identifiers, and using these to decrypt an encrypted PKI private key stored on an authentication server, ensuring that neither the user nor the service provider can obtain the key without mutual interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional hardware tokens are used to store private keys in a non-retrievable manner, then security is improved, but device complexity and cost increase significantly
Solution Approach 1:
The invention extracts the private key from physical hardware tokens and stores it in encrypted form on the service provider's server. The key is divided into multiple encrypted shares that require combination through multi-factor authentication, eliminating the need for complex hardware devices while maintaining security.
Solution Approach 2:
The service provider's server acts as an intermediary that holds encrypted private key shares and facilitates key reconstruction through multi-factor authentication. This intermediary approach replaces hardware tokens with a software-based solution that achieves similar security without the complexity of physical devices.
2Reliability
If multi-factor authentication with cryptographic hashes is implemented, then attack resistance is improved, but processing cost increases
Solution Approach 1:
Cryptographic hashes and encrypted private key shares are pre-computed and stored on the server before authentication is needed. During login, the system only needs to verify the hash against stored values and reconstruct the key, rather than performing complex cryptographic operations in real-time, reducing processing cost.
Solution Approach 2:
The system uses multiple factors for authentication (username, password, device identifier) but only computes cryptographic hashes for verification purposes. The private key itself is never fully reconstructed or transmitted, performing just enough cryptographic action to ensure security while minimizing processing overhead.
Data Source
AI summary
The present invention provides methods, systems and computer program products (software) for the reliable, attack-resistant authentication of a network-connected user to a network-connected service provider.