Multi-Stage Authentication Using Distributed Credential Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication systems are vulnerable to network breaches, where all authentication factors can be leaked and abused, despite encryption techniques, due to centralized management of these factors in server apparatuses.
Innovation Solution
A distributed authentication system where common and distributed authentication information is stored on a user storage medium and a server apparatus, with one-to-one authentication performed using a communication, read, and control part to prevent leakage of all authentication factors via the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If all authentication factors are managed by one or more server apparatuses, then authentication system can be simplified and centralized, but security strength deteriorates because all authentication factors may be leaked via network
Solution Approach 1:
The patent segments authentication factors into two types: common authentication information (stored on server) and distributed authentication information (stored on both server and user terminal). This segmentation prevents all authentication factors from being concentrated on the server, thereby reducing the security risk of complete authentication factor leakage while maintaining system manageability.
2Reliability
If authentication factors are distributed between server and user terminal, then security strength is improved by preventing complete leakage, but device complexity increases due to multiple storage locations
Solution Approach 1:
The patent divides authentication information into common authentication information (managed centrally on server) and distributed authentication information (stored on both server and user terminal). This segmentation allows the system to achieve enhanced security through distribution while maintaining manageable complexity by clearly defining what is centralized versus distributed.
Solution Approach 2:
The common authentication information serves multiple functions: it is used for authentication verification on the server and also as a reference for generating or validating distributed authentication information on the user terminal. This multi-functionality reduces the need for completely separate storage systems.
3Loss of information
If encryption techniques are used to anonymize authentication factors on server, then data protection is improved, but security vulnerability remains because all factors are still accessible via network
Solution Approach 1:
The patent extracts distributed authentication information from the server's complete authentication factor set and places it on the user terminal. This extraction ensures that even if the server is compromised or network interception occurs, the complete set of authentication factors cannot be obtained, as some factors are physically separated on the user's device.
Solution Approach 2:
By segmenting authentication factors into common and distributed portions, the patent creates a security architecture where encryption on the server protects the common authentication information, while the distributed authentication information on the user terminal provides an additional layer of security that cannot be accessed through network compromise alone.
Data Source
AI summary
Authentication apparatus includes: communication part capable of communicating with server apparatus that stores common authentication information and first distributed authentication information in association with each other via network; read part capable of reading information from user storage medium that stores common authentication information and second distributed authentication information; input part; and control part, wherein the control part authenticates by collating the second distributed authentication information acquired via the read part with the second distributed authentication information acquired from a user via the input part; transmits the common authentication information acquired via the read part to the server apparatus via the communication part; authenticates by collating the first distributed authentication information acquired from the server apparatus via the communication part with the first distributed authentication information acquired from the user via the input part; and unlocks a lock when completing authenticating all of the first distributed authentication information.