Secure Password Migration Across Authentication Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge of securely migrating passwords between authentication servers where the password is end-to-end encrypted and hashed, as different servers often use proprietary encryption and hashing methods, leading to compatibility issues and potential compromise of password confidentiality.
Innovation Solution
A method and system for securely migrating passwords by using a processor to manage the encryption and hashing process, involving the exchange of public keys and authentication parameters between servers, and employing multi-factor authentication to ensure seamless migration without compromising password security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password encryption and hashing methods are changed between authentication servers, then security is improved, but compatibility and ease of migration deteriorate
Solution Approach 1:
The patent introduces a migration server as an intermediary component that facilitates password migration between authentication servers with different encryption schemes. The migration server receives authentication requests, coordinates between the old and new authentication servers, and enables seamless password migration without requiring users to manually re-enter credentials, thus resolving the compatibility issue while maintaining security
Solution Approach 2:
The system performs preliminary actions by pre-configuring the migration server with knowledge of both the old encryption scheme (used by the first authentication server) and the new encryption scheme (used by the second authentication server). This allows the migration server to proactively handle the conversion and coordination before actual password migration occurs, enabling smooth transition between different security schemes
2Reliability
If end-to-end encryption is implemented, then password confidentiality is improved, but system complexity increases
Solution Approach 1:
The patent extracts the cryptographic operations (encryption, decryption, hashing) from the authentication servers and places them in dedicated cryptographic modules or hardware security modules. This separation of cryptographic functions from the main authentication logic simplifies the overall system architecture while maintaining strong end-to-end encryption, as the complexity is confined to specialized components rather than distributed throughout the entire system
3Reliability
If multi-factor authentication is used during migration, then security is improved, but user friction increases
Solution Approach 1:
The migration server implements self-service functionality by automatically coordinating the multi-factor authentication process between the old and new authentication servers. Instead of requiring users to manually configure or manage the authentication flow, the system automatically handles the coordination of multiple authentication factors, background verification steps, and server communications, thereby maintaining high security while minimizing user friction
Data Source
AI summary
A method and a system for securely performing a password migration between authentication servers where the password is end-to-end encrypted and hashed are provided. The method includes: after the user has received first and second public keys from the first and second servers, and after the user has stored, in a memory, first and second encrypted versions of the password that are respectively encrypted by using the first and second public keys, transmitting a request to perform an authentication with the first server based on the first encrypted version of the password; after a validated token has been issued by the first server, receiving a request to update the password in the second server based on the token, and transmitting the request to the second server, together with the second encrypted version of the password and a request to migrate the user to the second server.