Password Protection Using Patterned Hash Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password protection systems using hash functions face a tradeoff between security and storage space, with shorter hash values providing insufficient security that can be easily breached by attackers, while longer values require excessive storage.
Innovation Solution
The system employs a one-way function to generate a check value with a predetermined pattern, allowing only part of the check value to be stored, thereby reducing storage needs while maintaining high security, using cryptographic hash functions like SHA-1 or MD5, and optionally utilizing block ciphers or simulating one-way functions for low-resource devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the hash value length is increased to improve security, then the security level improves, but the storage space requirement increases
Solution Approach 1:
The hash value is segmented into two parts: a pattern portion and a remaining portion. The pattern portion follows a predetermined structure that can be reconstructed, while only the remaining portion needs to be stored. This segmentation allows the system to achieve high security with reduced storage requirements.
Solution Approach 2:
The pattern portion is extracted from the hash value and removed from storage requirements. Since the pattern is predetermined and can be regenerated, only the non-pattern portion needs to be stored in non-volatile memory, significantly reducing storage space while maintaining security.
2Quantity of substance
If the hash value length is decreased to reduce storage space, then the storage space requirement decreases, but the security level deteriorates
Solution Approach 1:
The system adds a temporal dimension to the authentication process by using a one-way function that transforms the stored hash value along with a time-based counter into a current expected value. This allows the system to effectively use a shorter stored value while achieving the security of a longer hash value through the additional dimensional transformation.
3Reliability
If a full hash value is stored to ensure security, then the security level improves, but the device cost increases
Solution Approach 1:
The hash value is segmented into a pattern portion and a remaining portion, where only the remaining portion is stored in expensive non-volatile memory. This segmentation directly reduces the amount of costly storage required, thereby reducing device manufacturing costs while maintaining security through the combined use of the stored portion and the reconstructable pattern.
Solution Approach 2:
The system changes the parameter of stored data from the complete hash value to only the non-pattern portion of the hash value. This parameter change reduces the storage requirements and associated costs while the security is maintained through the one-way function transformation that combines the stored portion with the pattern and time counter.
4Quantity of substance
If a shorter hash value is used to reduce storage space, then the storage space requirement decreases, but the time to brute-force attacks decreases
Solution Approach 1:
The system performs preliminary action by pre-defining a pattern structure for the hash value and storing only the non-pattern portion. This preliminary structuring allows the system to later reconstruct the full hash value when needed for authentication, effectively maintaining the security of a long hash value while storing only a short portion, thereby increasing the time required for brute-force attacks despite reduced storage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An authentication system, including a pattern module to provide a pattern, a function module to provide a one-way function having a plurality of input and output values, a function processor to find one of the input values for the one-way function such that a corresponding one of the output values has the pattern, a password module to provide the one input value as a password for use in password authentication against the one output value, the one output value being a check value having a length, a compression module to determine a storage value such that: the check value can be reconstructed from the storage value and the pattern, and the storage value has a length which is shorter than the length of the check value, and a storage module to store the storage value in a storage medium for later retrieval. Related apparatus and methods are also included.