Password Authentication Method Reducing Calculation Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods using Diffie-Hellman key exchange are not secure against Key Compromise Impersonation (KCI) attacks and require high calculation amounts, which is inefficient for low-capability devices and large user management systems.
Innovation Solution
A modified authentication method where the server computes the master secret Ks as gy, reducing the need for modulo exponentiation and allowing pre-computation, and the client computes Kc using Y and b, minimizing calculation loads while ensuring security against KCI attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional Diffie-Hellman key exchange is used for mutual authentication, then security against various attacks is achieved, but calculation amount increases significantly
Solution Approach 1:
The server pre-computes and stores password authentication data (password verifier) in advance, so that during actual authentication, only lightweight operations are needed. This eliminates the need for heavy modulo exponentiation during real-time authentication while maintaining security.
Solution Approach 2:
The patent transforms the authentication approach by changing from direct Diffie-Hellman key exchange to a password-verifier-based scheme where the server stores pre-computed values. This parameter change allows authentication to proceed with minimal calculation while achieving the same security goals.
2Reliability
If password verifier method is used to achieve security against KCI attack, then security is improved, but calculation amount on both client and server increases
Solution Approach 1:
The patent extracts the heavy calculation component (modulo exponentiation) from the real-time authentication process and moves it to a pre-computation phase on the server side. This separation allows the authentication protocol to use password verifiers for KCI security while minimizing online calculation requirements.
3Speed
If encryption key is stored in terminal for authentication, then authentication speed is improved, but security decreases due to key leakage risk
Solution Approach 1:
The patent introduces password authentication data as an intermediary that the server stores and uses to verify client credentials. Instead of storing encryption keys in the terminal, the server mediates authentication using pre-computed password verifiers, eliminating the security risk of key storage while maintaining fast authentication.
Data Source
AI summary
There is provided an authentication method which is secure against various attacks such as a KCI attack on a public network, and can reduce a required calculation amount compared to a conventional method. In this authentication method, a mutual authentication processing technique using Diffie-Hellman type key exchange is modified to compute a master secret Ks in a server by Ks=gy, where y is a random number (yε(Z/qZ)*) generated by the server. In this method, let (G,·) be a group of order q, g be a generator of that set G, and U, WεG. “·” is a binary operator on G.