Multi-Server Password Authentication via Distributed Ciphertext
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password-based authentication systems are vulnerable to offline attacks through server compromise, as storing passwords in hashed form offers little protection due to the efficiency of dictionary or brute-forcing attacks, especially with modern computational power.
Innovation Solution
A multi-server password authentication system where an access control server communicates with a plurality of authentication servers to implement a protocol using ciphertexts produced by encrypting user and input passwords, allowing central validation without reconstructing the password, and incorporating throttling mechanisms to prevent malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If passwords are stored in hashed form on a single server, then authentication can be performed efficiently, but the system becomes vulnerable to offline attacks through server compromise
Solution Approach 1:
The patent divides the authentication system into multiple servers (first server, second server, third server) that each store different portions of the hashed password. The first server stores a first hash value, the second server stores a second hash value, and the third server stores a third hash value. To authenticate a user, the system retrieves hash values from multiple servers and combines them, making it impossible for an attacker to mount offline attacks against a single compromised server.
2Reliability
If password data is split between multiple servers, then security against offline attacks is improved, but the complexity of the authentication protocol increases
Solution Approach 1:
The patent introduces a client computer as an intermediary that handles the complexity of coordinating communication with multiple servers. The client computer receives the user's password, computes appropriate hash values, and manages the retrieval and combination of hash values from the first, second, and third servers. This intermediary approach simplifies the authentication process for end users while maintaining the security benefits of multi-server distribution.
3Reliability
If all authentication servers must be contacted for password verification, then security is maximized, but the time required for authentication increases
Solution Approach 1:
The patent implements a threshold-based authentication mechanism where the system can authenticate users by contacting only a subset of servers rather than all servers. The configuration allows the authentication system to retrieve hash values from the first, second, and third servers selectively, enabling faster authentication when fewer servers are needed while maintaining security through the distributed hash value approach.
Data Source
AI summary
A password authentication system includes an access control server configured to control access by a user computer to a resource dependent on authentication of user passwords associated with user IDs. The system further includes a plurality of authentication servers, storing respective secret values. For each user ID, the access control server stores a first ciphertext produced by encrypting the user password associated with that ID using a predetermined algorithm dependent on the secret values. In response to receipt of a user ID and an input password, the access control server communicates with the plurality of authentication servers to implement password authentication, requiring use of the secret values, in which a second ciphertext is produced by encrypting the input password using said predetermined algorithm. The access control server compares the first and second ciphertexts to determine whether the input password equals the user password to permit access to the resource.