Password Authentication via Distributed Server Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure password-authenticated key agreement (SPAKA) protocols are vulnerable to server compromise, allowing attackers to expose password databases and mount offline dictionary attacks, and impose significant computational overhead and complexity on users and servers.
Innovation Solution
A network-based system using two servers to securely authenticate clients with limited computational resources, where shares of a password are generated and processed to determine correspondence without requiring further client-server interaction, allowing for efficient authentication using weak passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional SPAKA protocols are used for secure authentication, then password-based authentication can be achieved, but the server becomes vulnerable to compromise and password databases can be exposed
Solution Approach 1:
The password is segmented into multiple shares using secret sharing schemes, where no single server holds the complete password. This segmentation ensures that even if one server is compromised, the attacker cannot reconstruct the full password without additional shares from other servers, thus resolving the vulnerability to server compromise while maintaining authentication security.
Solution Approach 2:
The patent introduces cryptographic intermediaries and protocols that mediate between the client and servers during authentication. These intermediaries enable the client to authenticate with multiple servers without any single server gaining full access to the password, thereby protecting against server compromise while achieving reliable authentication.
2Object-affected harmful factors
If SPAKA protocols with multiple servers are implemented to prevent server compromise, then security against password exposure improves, but computational overhead and system complexity increase
Solution Approach 1:
By segmenting the password into shares distributed across multiple servers, the system prevents password exposure risk while maintaining manageable complexity. Each server handles only a portion of the authentication process, simplifying individual server operations while achieving collective security through the distributed architecture.
Solution Approach 2:
The patent implements preliminary key establishment and share distribution phases before actual authentication occurs. This preliminary action prepares the system in advance, so that during runtime authentication, the complex cryptographic operations have already been set up, reducing real-time computational overhead and simplifying the user experience.
3Object-affected harmful factors
If password shares are distributed across multiple servers, then resistance to offline dictionary attacks improves, but the authentication process requires more complex protocols
Solution Approach 1:
The password segmentation into distributed shares fundamentally prevents offline dictionary attacks, as attackers cannot obtain complete password material for offline cracking. The protocol complexity introduced by this segmentation is managed through structured cryptographic procedures that systematically handle share combination and verification across servers.
Solution Approach 2:
The patent incorporates feedback mechanisms where servers verify authentication attempts and provide responses to clients based on the collective verification of password shares. This feedback loop ensures that even with complex multi-server protocols, the authentication process remains controlled and verifiable, with servers communicating verification results back to clients in a standardized manner.
Data Source
AI summary
Secure authentication protocols, particularly well-suited for use in authenticating mobile communications devices having limited computational resources, are disclosed. In an illustrative embodiment, a network-based communication system includes a client device and at least two servers. First and second shares are generated from a first password associated with the client device, and stored in respective first and second servers. The client device submits additional information associated therewith to at least one of the first and second servers. Each of the first and second shares has the property that it is infeasible to determine solely therefrom correspondence of the additional information with the first password. The first and second servers then utilize the respective first and second shares to collectively determine said correspondence of the additional information with the first password.