Mutual Authentication Using Bilinear Pairings Without Password Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based authentication systems are vulnerable to attacks such as dictionary attacks, brute-force attacks, and password spraying, leading to unauthorized access, and existing password-less systems incur high costs and inconvenience due to the need for hardware tokens and complex key management.
Innovation Solution
A method and system using key-pair techniques to generate public and private keys for user authentication, leveraging bilinear pairings and ElGamal encryption to authenticate users without revealing password information, allowing recovery in case of forgotten credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-based authentication is used, then authentication simplicity is improved, but security deteriorates due to vulnerability to guessing attacks
Solution Approach 1:
The patent extracts the password information from the authentication process entirely. Instead of using passwords, the system uses public key infrastructure where only public keys and cryptographic proofs are transmitted. The server never receives or stores password information, eliminating the vulnerability to password guessing attacks while maintaining authentication functionality.
Solution Approach 2:
The patent introduces cryptographic protocols as intermediaries between the user and server. The authentication is performed through cryptographic proofs and challenge-response mechanisms rather than direct password transmission. This intermediary layer protects both parties by allowing verification without exposing sensitive credentials.
2Reliability
If password-less authentication systems are implemented, then security is improved, but device complexity and cost increase due to hardware tokens
Solution Approach 1:
The patent uses cryptographic key pairs where the private key acts as a digital copy that never leaves the user's device. The public key serves as a public copy that can be freely shared. This eliminates the need for physical hardware tokens while maintaining the security benefits of password-less authentication, as the cryptographic keys provide the same security function without requiring specialized hardware.
3Ease of operation
If password information is stored on server, then authentication functionality is improved, but loss of information increases due to security breaches
Solution Approach 1:
The patent extracts password information completely from the server's data storage. The server stores only public keys and authentication proofs, never password hashes or plaintext passwords. This extraction eliminates the risk of password database breaches while preserving authentication functionality through cryptographic verification.
4Ease of operation
If traditional authentication systems are used, then ease of operation is improved, but object-generated harmful factors increase due to unauthorized access
Solution Approach 1:
The patent converts the potential harm of credential theft into benefit by using asymmetric cryptography. The public key, which must be visible to the server for authentication to work, cannot be used to derive the private key or impersonate the user. This transforms what could be a security vulnerability (exposing authentication credentials) into a security advantage (the exposed public key provides no useful information to attackers).
Data Source
AI summary
Password based authentication is one of the common forms of authentication used in practice. However, when a user/client device enrolls with a server using password information, the authentication process exposes hash of password information to the server which is prone to various types of passwords guessing attacks. Present disclosure provides a system and a method that authenticates a user without revealing his/her password information to a third-party identity provider. This is done by using bilinear parings to authenticate user without sending password information to the server and by way generating client shared secret, server secret, public key, private key and the like. This eliminates the need for storing any keys on multiple devices/third parties or storing password information on the server side.