Password Management via Server-Specific PUF Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password management systems face significant security risks when storing user passwords on cloud servers, as a single breach can compromise all passwords, and hashed versions can still be useful to hackers, potentially harming users and companies.
Innovation Solution
A password management system that encrypts user passwords with a server-specific key, using a physical unclonable function (PUF) to generate the key, which is unique to each server, reducing the risk of password exposure by requiring physical access to the PUF, and issuing an access token with a predefined lifetime for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored encrypted at a cloud server using a centralized database, then password management becomes convenient and accessible, but a single security breach can compromise all stored passwords
Solution Approach 1:
The patent segments the password security architecture by distributing password storage across multiple independent servers instead of using a centralized database. Each server stores a portion of passwords, and no single server contains all passwords. This segmentation ensures that a breach of one server only exposes a fraction of total passwords, directly addressing the security vulnerability of centralized storage while maintaining accessibility through the distributed network.
2Reliability
If hashed versions of passwords are stored to improve security, then the risk of direct password exposure is reduced, but hashed passwords can still be useful to hackers for credential stuffing attacks
Solution Approach 1:
The patent extracts the salting mechanism from conventional password storage and applies it systematically across the distributed server network. Each server generates and applies unique salts to password portions before storage. This extraction and application of salting ensures that even if hackers obtain hashed passwords from one server, they cannot use pre-computed rainbow tables or efficiently crack multiple passwords simultaneously, rendering the stored data significantly less useful for credential stuffing attacks.
Solution Approach 2:
The patent implements local quality by assigning different security parameters to different servers in the distributed network. Each server has its own unique salt, encryption key, and stores only a specific portion of passwords. This local differentiation ensures that compromising one server does not provide attackers with information useful for attacking other servers, as each server's cryptographic parameters are independent and locally optimized for security.
3Reliability
If a server-specific key is used to encrypt passwords, then the security against unauthorized access is improved, but the complexity of key management increases
Solution Approach 1:
The patent implements self-service through automated key generation and management systems. Each server in the distributed network automatically generates its own cryptographic keys and salts without requiring manual intervention. The system autonomously manages key distribution, rotation, and revocation across servers. This automation eliminates the operational burden of manual key management while maintaining strong security through server-specific cryptographic parameters.
Data Source
AI summary
The present disclosure relates to a password management system and to a method for operating such a password management system. The password management system operates in communication with a client device running a cookie enabled browser application. The present disclosure also relates to a method for allowing access to restricted information stored at a server.