Password Authenticator Token Generation via Segmented Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password management systems are vulnerable to attacks, such as pre-computed hash table attacks and privilege escalation, due to the use of fast cryptographic hash functions and inadequate protection mechanisms, leading to security breaches and a 'password arms race' between attackers and system implementers.
Innovation Solution
A system and method that employs a password management module and a restricted secret server with a very large key module, using a block of unpredictable data and a deterministic random number generator to generate a password authenticator token, which is combined with the password for secure storage and verification, thereby enhancing security and resistance to quantum computing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If fast cryptographic hash functions are used for password verification, then authentication speed is improved, but security is worsened due to vulnerability to pre-computed hash table attacks
Solution Approach 1:
The patent segments the password verification process into two distinct phases: a fast phase using cryptographic hash functions for initial authentication, and a slow phase using memory-hard functions as a secondary verification layer. This segmentation allows the system to benefit from both speed and security, as the fast phase provides quick authentication while the slow phase prevents pre-computed hash table attacks by requiring additional computational resources that cannot be easily pre-calculated
Solution Approach 2:
The patent implements preliminary action by requiring users to complete a proof-of-work computation before their password can be verified. This preliminary computation, stored in the user's account record, must be performed again during authentication, ensuring that even if an attacker obtains the password hash, they cannot bypass the memory-hard verification step without performing the same computationally intensive operation
2Ease of operation
If password database is stored with plaintext passwords, then ease of verification is improved, but security is worsened due to risk of database breaches
Solution Approach 1:
The patent extracts the security-critical components (passwords and verification data) from the main user database and stores them in a separate, securely isolated password verification database. This extraction ensures that even if the main database is compromised, the actual passwords remain protected. The system maintains ease of verification by implementing efficient lookup mechanisms in the separated database while enforcing security through architectural isolation and access controls
Solution Approach 2:
The patent introduces an intermediary component - the password verification module - that acts as a mediator between the user authentication process and the stored password data. This intermediary enforces security policies, manages the complex verification process involving multiple hash functions, and controls access to the password database, thereby maintaining both security and operational ease without requiring direct access to plaintext passwords
3Reliability
If salt is added to break pre-computed attacks, then security is improved, but device complexity is worsened due to additional data storage requirements
Solution Approach 1:
The patent merges the salt, the password hash, and the proof-of-work verification data into a single integrated password verification record. This combining approach simplifies data storage by eliminating the need for separate salt storage structures, while still maintaining security benefits. The merged record structure allows the system to enforce memory-hard requirements without adding significant operational complexity, as all necessary components are contained within a unified data structure that can be processed atomically
4Reliability
If memory-hard functions are used to prevent attacks, then security is improved, but processing speed is worsened
Solution Approach 1:
The patent implements a dynamic verification process where the system adapts between fast and slow verification modes based on the authentication context. The fast cryptographic hash phase provides immediate feedback for correct passwords, while the memory-hard function phase is selectively applied as a secondary verification layer. This dynamic approach allows the system to maintain high processing speed for legitimate users while enforcing security constraints that slow down potential attackers, effectively decoupling user experience from security enforcement
Data Source
AI summary
A system and method for storing and accessing password verification data on multi-user computer systems that prevents remote attacks. Along with commonly-employed measures that limit the number of unsuccessful attempts to login or otherwise verify a password, it allows users to choose relatively simple passwords with full security. The secret component cannot be easily leaked or exfiltrated does not require periodic backup and is isolated in a way that allows it to be protected by conventional security measures such as safes, alarm systems and video surveillance from attackers who somehow gain access to the computing facility.