Password Authentication Segmentation for Speed and Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password management systems are vulnerable to attacks, such as pre-computed hash table attacks and privilege escalation, due to the use of fast cryptographic hash functions and inadequate protection mechanisms, leading to security breaches and the 'password arms race' between attackers and system implementers.
Innovation Solution
A secure system and method for password authentication that involves a password management module generating a salt, securely sending it to a restricted secret server with a very large key module, using unpredictable data to create a password authenticator token, and combining it with the password for hashing, thereby reducing the need for complex passwords and enhancing security without additional user burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If fast cryptographic hash functions are used for password validation, then authentication speed is improved, but security is worsened due to vulnerability to pre-computed hash table attacks
Solution Approach 1:
The patent segments the password validation process into two distinct phases: authentication phase (fast hash comparison) and password change phase (slow key derivation with memory-hard functions). This segmentation allows fast authentication while ensuring strong security for password changes, resolving the contradiction between speed and security.
Solution Approach 2:
The patent performs preliminary key derivation and validation data generation during the password change phase, storing the result in the user record. During authentication, this pre-computed validation data is used for fast comparison without repeating the computationally intensive key derivation, thus achieving both speed and security.
2Ease of operation
If password validation data is stored in the database, then authentication functionality is improved, but security is worsened due to risk of database compromise
Solution Approach 1:
The patent changes the parameter of validation data from traditional hash values to memory-hard key derivation results that incorporate salts and unique identifiers. This transformation ensures that even if the database is compromised, the validation data cannot be efficiently reused for password guessing attacks, maintaining security while preserving authentication functionality.
3Reliability
If complex password requirements are implemented, then security is improved, but user convenience is worsened
Solution Approach 1:
The patent implements automatic salt generation and inclusion in the validation data, eliminating the need for users to manually create complex passwords. The system self-manages the security enhancements by automatically incorporating unique salts and identifiers into the key derivation process, improving security without burdening users.
Data Source
AI summary
A system and method for storing and accessing password verification data on multi-user computer systems that prevents remote attacks. Along with commonly-employed measures that limit the number of unsuccessful attempts to login or otherwise verify a password, it allows users to choose relatively simple passwords with full security. The secret component cannot be easily leaked or exfiltrated does not require periodic backup and is isolated in a way that allows it to be protected by conventional security measures such as safes, alarm systems and video surveillance from attackers who somehow gain access to the computing facility.