Mutual Authentication Using Key Pairs Without Password Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-based authentication systems are vulnerable to attacks such as dictionary attacks, brute-force attacks, and password spraying, leading to unauthorized access, and existing password-less systems face challenges with key management and computational expense.
Innovation Solution
A method and system using key-pair techniques to generate private and public keys, enabling secure mutual authentication between client and server without revealing password information, with mechanisms for recovering from forgotten credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used, then authentication is implemented, but the system becomes vulnerable to dictionary attacks, brute-force attacks, and password spraying
Solution Approach 1:
The patent extracts the vulnerable password information from the authentication process and replaces it with cryptographic key-pair mechanisms. The server stores only encrypted data and public keys, while the client holds private keys, eliminating the need to store or transmit vulnerable password hashes that can be attacked through dictionary attacks, brute-force attacks, or password spraying.
Solution Approach 2:
The patent introduces cryptographic intermediaries (public keys and encrypted shared secrets) between the client and server. Instead of directly using passwords for authentication, the system uses key-pair cryptography as an intermediary mechanism that provides secure authentication without exposing vulnerable password information to the server or during transmission.
2Reliability
If password-less authentication with key-pair techniques is used, then authentication security is improved, but key management complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the client device automatically generates and stores its own private keys, and the server automatically manages encryption of shared secrets using the client's public key. This eliminates the need for complex centralized key management while maintaining high security through automated cryptographic operations performed by the devices themselves.
3Reliability
If mutual authentication is implemented, then both client and server are authenticated, but computational expense increases
Solution Approach 1:
The patent implements mutual authentication through partial cryptographic actions where each party performs only the necessary computations required for authentication. The server performs encryption using the client's public key, and the client performs decryption using its private key, rather than requiring both parties to perform all cryptographic operations, thus reducing overall computational expense while maintaining mutual authentication.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Password based authentication is one of the common forms of authentication used in practice. However, when a user/client device enrolls with a server using password information, the authentication process exposes hash of password information to the server which is prone to various types of passwords guessing attacks. Present disclosure provides a system and a method that authenticates a user without revealing his/her password information to a third-party identity provider. This is done by using bilinear parings to authenticate user without sending password information to the server and by way generating client shared secret, server secret, public key, private key and the like. This eliminates the need for storing any keys on multiple devices/third parties or storing password information on the server side.