Multi-Party Dynamic Encryption Authentication Against Credential Theft
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber security threats, such as phishing scams and DDoS attacks, exploit vulnerabilities in traditional login authentication methods like username and password verification, rendering existing security measures like PKI, HTTPS, KDC, and MFA insufficient.
Innovation Solution
A cyber security method and system employing multi-party and multi-factor dynamic strong encryption authentication, involving the generation of ephemeral decryption keys, token indices, and electronic digital signatures across multiple devices to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional username and password verification is used, then ease of operation is improved, but security reliability deteriorates due to phishing scams, DDoS attacks, and credential theft
Solution Approach 1:
The patent introduces a security server as an intermediary between the user's first device and the service provider's second device. This mediator facilitates secure authentication by receiving ephemeral decryption keys from the user, retrieving token indices, and enabling verification without exposing sensitive credentials. The intermediary architecture resolves the contradiction by adding security layers while maintaining user-friendly operation through automated key management and background verification processes.
Solution Approach 2:
The patent employs dynamic ephemeral decryption keys that are randomly generated for each authentication session and automatically deleted after use. This dynamic approach replaces static usernames and passwords with transient cryptographic credentials, ensuring that even if one key is compromised, it cannot be reused. The system maintains ease of operation by automatically managing the lifecycle of these dynamic keys without requiring user intervention.
2Reliability
If advanced security measures like PKI, HTTPS, KDC, and MFA are implemented, then authentication security is improved, but device complexity increases
Solution Approach 1:
The patent segments the authentication system into three distinct functional components: a first device for key generation and token creation, a security server for key management and coordination, and a second device for verification. This segmentation distributes complexity across multiple specialized components rather than concentrating it in a single system, making the overall architecture more manageable and maintainable while achieving high security through division of labor.
3Reliability
If ephemeral decryption keys and multi-factor authentication are used, then security against cyber threats is improved, but processing time and computational overhead increase
Solution Approach 1:
The patent performs preliminary actions by pre-generating and storing token indices in the security server before authentication is needed. During the actual authentication process, the system only needs to retrieve the pre-stored token index and perform a single verification operation, rather than computing complex cryptographic proofs in real-time. This preliminary preparation significantly reduces authentication duration while maintaining high security through the use of ephemeral keys and digital signatures.
Data Source
AI summary
The present invention relates to a cyber security method, which includes: in a first device: randomly generating an ephemeral decryption key (EDK) in response to an input of an authentication information (AI); transmitting the EDK to a third device and retrieving a token index (TI) from the third device; encrypting an ID info to generate an electronic digital signature (EDS) based on a part of the EDK to generate an authentication token (AT) accordingly; and combining the AI, the ID info, the TI and the AT to form an ephemeral string and sending the ephemeral string to a second device; and in the second device: acquiring the AI, the ID info, the TI and the AT by parsing the ephemeral string and requesting to retrieve the EDK from the third device based on the TI; and decrypting the AT and verifying the EDS based on the EDK.