Password Hardening via Dual-Server Chaff Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-hardening systems are vulnerable to attacks, particularly when the master password is compromised, as they often store multiple valid passwords in a single location, leading to security risks and user burden.
Innovation Solution
A password-hardening system utilizing two servers, where one server stores sets of passwords including a valid password and chaff passwords, and the other server stores valid password indication information, with proactive updating of these sets and information across epochs, ensuring enhanced security by obscuring the valid password within a set of decoy passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple valid passwords are stored in a single location (password vault or hashed password file), then user access is simplified, but security is compromised when the master password is breached
Solution Approach 1:
The system divides the password storage function across two separate servers: the first server stores password sets (containing valid and chaff passwords) while the second server stores only the valid password indication information. This segmentation ensures that compromising one server does not reveal all valid passwords, thereby maintaining security while preserving user access capability.
Solution Approach 2:
The patent introduces chaff passwords as intermediary elements mixed with valid passwords in the first server's storage. These chaff passwords act as decoys that obscure the location of valid passwords, forcing attackers to expend additional effort to identify the correct password among multiple candidates.
2Reliability
If multiple distinct passwords are required for different applications and accounts, then security is improved, but user burden increases due to the need to remember multiple passwords
Solution Approach 1:
The system provides a universal password management solution where a single master password protects access to multiple application-specific password sets stored on the first server. Users only need to remember and provide this one master password, while the system handles the complexity of storing and managing multiple application-specific passwords through the two-server architecture.
3Ease of operation
If passwords are written down or stored in easily accessible locations, then ease of operation is improved, but security is undermined due to vulnerability to inadvertent disclosure
Solution Approach 1:
The system creates multiple copies of password information in a secured environment: the first server stores encrypted password sets while the second server stores indication information. This distributed copying eliminates the need for users to write down passwords or store them in easily accessible locations, as the system maintains secure redundant copies across multiple servers.
Data Source
AI summary
A password-hardening system comprises at least first and second servers. The first server is configured to store a plurality of sets of passwords for respective users with each such set comprising at least one valid password for the corresponding user and a plurality of chaff passwords for that user. The second server is configured to store at least a portion of valid password indication information indicating for each of the sets which of the passwords in that set is a valid password. The first and second servers are further configured to proactively update the sets of passwords and the valid password indication information in each of a plurality of epochs. The valid password indication information may comprise, for example, valid password index values for respective ones of the users, with the index values being stored as a shared secret across the first and second servers.