Passcode Management via Segmented Cryptographic Messages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password authentication methods are vulnerable to shoulder surfing and hacking, necessitating a more secure approach to protect personal data.
Innovation Solution
A passcode management system that includes a processor, memory, and modules for generating and managing combination codes based on user input, encrypting and decrypting passcodes, and storing them securely using a passcode storage server, with separate storage addresses and code tables for different purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a password is stored and compared for authentication, then user authentication can be performed, but the password becomes vulnerable to stealing and hacking
Solution Approach 1:
The authentication system is divided into multiple independent components: the user terminal generates a first cryptographic message using a master password, the password server stores this message along with a server user ID, and during authentication, the terminal generates a second cryptographic message. Neither the terminal nor the server stores the actual password, segmenting the authentication process to eliminate password vulnerability.
Solution Approach 2:
Cryptographic messages serve as intermediaries between the user and the authentication system. Instead of directly handling passwords, the system uses first and second cryptographic messages generated through cryptographic functions. These intermediary messages protect the master password from exposure while enabling secure authentication verification.
2Ease of operation
If a password is inputted and stored in the terminal, then authentication can be performed, but the password key may be hacked by hacking programs
Solution Approach 1:
The actual password is extracted from the authentication process and never stored in the terminal or server. Only cryptographic messages derived from the password are stored. This extraction eliminates the vulnerability to hacking programs that target stored passwords, while the cryptographic messages maintain authentication functionality.
Solution Approach 2:
Cryptographic messages are generated fresh for each authentication session and discarded afterward. The first cryptographic message is stored on the server, but the second cryptographic message is generated temporarily during authentication and then discarded. These disposable cryptographic objects replace persistent password storage, eliminating long-term vulnerability to hacking.
3Reliability
If cryptographic functions are downloaded from the password server to the user terminal, then secure authentication can be achieved, but the system complexity increases
Solution Approach 1:
The password server performs multiple functions: it stores the user ID and first cryptographic message, manages the code table, and provides cryptographic functions to terminals. By making the server universal and multi-functional, the terminal's complexity is reduced while maintaining overall system security through centralized cryptographic management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a method and apparatus for managing a passcode for safely protecting personal data of a user. The apparatus for managing a passcode according to the present invention comprises: one or more processors; a memory; and one or more programs stored in the memory and configured to be executed by said one or more processors. The program comprises: a storage module for storing passcode management data; an input window module for displaying the input window on which multiple key buttons are arranged; a combination code generating module for checking the code corresponding to each inputted key button in the code table included in the passcode management data, when the key button is inputted via the input window, and generating a combination code by combining each checked code; and a passcode acquiring module for receiving the passcode with a set storage address from a passcode storage server based on the generated combination code.