Partial Password Authentication via Encrypted Secret PIN
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based authentication methods are vulnerable to keyloggers and shoulder surfing, and existing multi-factor authentication schemes require the full password to be entered on the client device, which is not secure.
Innovation Solution
A method where a client device receives a randomly selected encrypted secret PIN and a challenge for corresponding positions of a Partial Password from a server, allowing the client to compute a secret PIN to unlock an Additional Factor for authentication, without requiring the full password to be entered.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the full password is entered on the client device for multi-factor authentication, then the authentication process can be completed, but the system becomes vulnerable to keyloggers and shoulder surfing attacks
Solution Approach 1:
The patent divides the full password into multiple discrete character positions that are challenged separately during authentication. Instead of requiring the complete password to be entered, the system segments it into individual character challenges at specific positions, making it impossible for keyloggers to capture the full password and reducing shoulder surfing effectiveness since not all positions are visible simultaneously.
Solution Approach 2:
The patent extracts only the necessary portions of the password (specific character positions) required for authentication rather than requiring the full password. By taking out only the challenged positions and verifying them against the stored password segments, the system achieves authentication while minimizing password exposure to attackers.
2Object-affected harmful factors
If partial password challenges are used to protect against keyloggers, then security against keylogging improves, but the authentication process becomes more complex
Solution Approach 1:
The patent performs preliminary computation of all possible partial password combinations and their corresponding hash values before the authentication process. By pre-computing these challenge-response pairs and storing them securely, the system can quickly present challenges during authentication without requiring complex real-time computation, thus reducing the perceived complexity for the user while maintaining security.
Solution Approach 2:
The patent introduces a server-based authentication mechanism that acts as an intermediary between the client and the password verification process. The server handles the complex logic of generating challenges, verifying partial password responses, and managing the challenge-response protocol, thereby simplifying the client device's role and reducing overall system complexity while maintaining strong security.
3Ease of operation
If the full password is stored and processed on the client device, then authentication functionality is simplified, but the risk of password exposure increases
Solution Approach 1:
The patent extracts only the necessary character positions from the full password for authentication purposes. Instead of storing or processing the complete password on the client device, the system extracts and verifies only the challenged positions, thereby maintaining authentication functionality while minimizing the amount of sensitive information that needs to be protected on the client side.
Solution Approach 2:
The patent uses cryptographic hash functions to create secure copies of the password segments rather than storing the actual password characters. The server stores hashed versions of password segments, and during authentication, the client computes hashes of the entered partial password and compares them against the stored hashes, eliminating the need to store or transmit the actual password while maintaining verification capability.
Data Source
AI summary
A method includes transmitting a User ID and a full Password of a user of a client device to a server via the client device, and then establishing a network connection between the client device and the server after the User ID and the full Password. The method also includes receiving, from the server via the client device, an encrypted secret PIN (ESPIN) and a challenge for corresponding positions of a Partial Password, entering the Partial Password via the client device, and computing a secret PIN (SPIN) from the ESPIN via the client device in response to a correct entry of the Partial Password. The Additional Factor is unlocked using the SPIN, and the unlocked Additional Factor is transmitted to the server to request authentication of the user of the client device. The client device includes a processor and memory having instructions for the above method.