Password Hardening System Using Distributed Shares
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise environments face vulnerabilities in password security due to the storage of weak, hashed passwords without salt, particularly in deprecated protocols like LAN Manager and NTLM, which are susceptible to rainbow table attacks, making domain controllers a single point of compromise.
Innovation Solution
A password hardening system is implemented between clients and authentication entities, distributing shares of weak and hardened surrogate passwords across multiple servers, intercepting communications to replace weak passwords with hardened ones, thereby simulating authentication protocols and avoiding a single point of compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored in deprecated hash formats (LM, NTLM) for legacy compatibility, then ease of operation is improved, but password security deteriorates due to vulnerability to rainbow table attacks
Solution Approach 1:
The patent introduces a password hardening system as an intermediary layer between legacy authentication entities and the network. This intermediary transparently intercepts authentication traffic, converts weak passwords into strong surrogate passwords, and forwards them to the authentication entity. This allows legacy systems to maintain compatibility while the intermediary enforces strong password policies without requiring changes to the legacy authentication protocols themselves.
2Ease of operation
If domain controllers store all user passwords centrally, then ease of operation is improved for authentication management, but security deteriorates by creating a single point of compromise
Solution Approach 1:
The patent segments the password storage function by separating the authentication management role from the password storage role. The password hardening system stores strong surrogate passwords while domain controllers store only weak original passwords for protocol compatibility. This segmentation ensures that even if the domain controller is compromised, attackers cannot obtain strong passwords, and the password hardening system's distributed architecture prevents single-point failure.
3Ease of operation
If password hashing is performed without salt for legacy compatibility, then ease of operation is improved, but security deteriorates due to susceptibility to rainbow table attacks
Solution Approach 1:
The patent changes the fundamental parameter of password strength by converting weak passwords into strong surrogate passwords before transmission to the authentication entity. The password hardening system applies cryptographic transformations that increase password entropy and length, ensuring that even if the authentication entity uses legacy hashing without salt, the transformed passwords resist rainbow table attacks due to their increased complexity and entropy.
Data Source
AI summary
A password hardening system is arranged between one or more clients and a domain controller or other authentication entity. The password hardening system comprises a plurality of servers configured to store in a distributed manner respective shares of at least one of a hardened surrogate password and a corresponding user password. The password hardening system is configured to intercept a first set of one or more communications based at least in part on the user password and directed to an authentication entity external to the password hardening system, and to provide to the authentication entity in place of at least a portion of the intercepted first set of one or more communications a second set of one or more communications based at least in part on the hardened surrogate password. The password hardening system may be configured to serve as a proxy between an authenticating client and the authentication entity.