Multi-party Secure Authentication via Password Dispersal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication techniques fail to ensure security when an intermediate server is present, such as in Web services, and are limited to storage services only.
Innovation Solution
A multi-party secure authentication method involving password dispersal, encryption, and verification across multiple servers, including an intermediate server, using secret sharing and cryptographic techniques to ensure secure authentication without revealing the password to any single server or intermediate party.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If prior-art authentication techniques are used, then authentication can be performed in storage services, but security cannot be ensured when an intermediate server exists
Solution Approach 1:
The password is divided into multiple dispersed values stored across different servers. Each server holds only a portion of the password information, and no single server or intermediate server can access the complete password. Authentication requires cooperation from multiple servers to reconstruct the password, thereby eliminating the security vulnerability in prior-art systems where intermediate servers could intercept complete password transmissions.
Solution Approach 2:
The patent introduces verification values as intermediary elements that enable authentication without direct password transmission. Instead of transmitting the actual password through the intermediate server, the system uses encrypted dispersed password values and verification values that can be validated by the intermediate server without revealing the password, thus maintaining security while allowing intermediate server operation.
2Adaptability or versatility
If prior-art authentication techniques are used, then authentication works for storage services, but cannot be applied to other services
Solution Approach 1:
The authentication mechanism is designed with universal applicability across different service types. The multi-party authentication protocol using dispersed password values and verification values can be implemented in various services (web services, cloud services, etc.) without requiring service-specific modifications. The system maintains consistent security properties while adapting to different service architectures, making it universally applicable rather than limited to storage services only.
3Reliability
If multiple servers are involved in authentication, then authentication security is improved, but communication complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-computing and distributing dispersed password values to multiple servers during system setup. This preliminary distribution eliminates the need for real-time complex communications during authentication, as the servers already possess the necessary dispersed values. The authentication process then involves only verifying these pre-distributed values rather than establishing new communication channels for each authentication step.
Data Source
AI summary
Even when an intermediate server exists, a plurality of servers simultaneously authenticates a user securely. A user apparatus disperses a password. The user apparatus obtains a ciphertext, which is obtained by encrypting a dispersed value. The intermediate server transmits the ciphertext to an authentication server. The authentication server decrypts the ciphertext to obtain the dispersed value. The authentication server determines a verification value. The authentication server obtains a ciphertext. The intermediate server decrypts the ciphertext to obtain the verification value. The intermediate server verifies whether a sum total of the verification values is equal to 0 or not. The authentication server determines a verification value. The authentication server obtains a ciphertext. The authentication server decrypts the ciphertext to obtain the verification value. The authentication server verifies whether a sum total of the verification values is equal to 0 or not.