Offline Login Authentication via Segmented Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication protocols face challenges in securely performing offline login processes, as they rely on storing passwords and decryption keys on local devices, making them vulnerable to malicious access if compromised.
Innovation Solution
The system generates a symmetric key from two values stored on different devices, encrypts the password with the symmetric key, and uses auxiliary keys to ensure secure offline login by decrypting the password without storing the symmetric key on the local device, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords and decryption keys are stored on local devices for authentication, then login convenience is improved, but security is worsened due to vulnerability to malicious access
Solution Approach 1:
The authentication system is segmented into multiple components: authentication service, local device, and authenticator. Each holds different cryptographic materials (passwords, keys, tokens) so that no single component contains all authentication credentials. This segmentation ensures that even if one component is compromised, the complete authentication system remains secure.
Solution Approach 2:
The authenticator serves as an intermediary device that mediates between the local device and authentication service. It holds auxiliary authentication materials and verifies user identity through additional factors (PIN, biometrics). This intermediary layer prevents direct access to stored credentials on the local device, adding a security buffer against malicious access.
2Adaptability or versatility
If symmetric keys are stored on local devices for password decryption, then offline login capability is improved, but security is worsened due to key exposure risk
Solution Approach 1:
The decryption capability is segmented by storing the symmetric key on the authenticator rather than the local device. The local device retains only the encrypted password and verification logic. This segmentation enables offline login functionality while preventing key exposure, as the key never resides on the vulnerable local device.
Solution Approach 2:
The symmetric key is extracted from the local device and placed on the authenticator. This extraction removes the security vulnerability of storing decryption keys on the local device while preserving offline login capability, since the key can be temporarily provided during authentication without being stored.
3Object-affected harmful factors
If auxiliary keys are generated and encrypted with symmetric keys for secure storage, then security is improved, but device complexity is worsened
Solution Approach 1:
The cryptographic system is segmented into multiple key types with specific functions: password for initial authentication, symmetric key for password encryption, and auxiliary key for secure storage. Each key type is managed by different system components, distributing complexity across the architecture rather than concentrating it in one location.
Solution Approach 2:
The system uses different cryptographic parameters (key types, encryption methods) for different security requirements. The symmetric key provides strong encryption for password storage, while the auxiliary key provides additional security layer. These parameter changes enhance security without requiring fundamental architectural changes.
Data Source
AI summary
A computer-based system and method for performing an offline login to a local device, including: generating a pair of an auxiliary (AUX) public key and an AUX private key; receiving a password at the local device; reconstructing a symmetric key from a first value stored on the local device and a second value stored on an authenticator; encrypting the password with the AUX public key to obtain a locally encrypted password; encrypting the AUX private key with the symmetric key to obtain an encrypted AUX private key; and deleting the symmetric key, and when performing the offline login: reconstructing the symmetric key; decrypting the encrypted AUX private key with the symmetric key to obtain the AUX private key; decrypting the locally encrypted password with the AUX private key to obtain the password; and using the password to perform the offline login.