Password Segmentation for Secure Multi-Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The management of multiple user accounts with different username/password combinations leads to security vulnerabilities, as users often reuse passwords or write them down insecurely, making it difficult to maintain strong authentication across various network resources.
Innovation Solution
An authentication scheme that uses a password server to generate a password, dividing it into an initial and remaining portion, where the initial portion is sent to a mobile communication device and the remaining portion to a password client, which combines to form a complete password for authentication, ensuring security without exposing the full password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users manage multiple username/password combinations, then access to multiple network resources is enabled, but security vulnerabilities increase due to password reuse and insecure storage
Solution Approach 1:
The password is segmented into two portions: a first portion stored securely on the server and a second portion provided to the user through the mobile device. This segmentation allows the system to maintain strong passwords on the server while providing user access, resolving the contradiction between security and accessibility across multiple resources.
Solution Approach 2:
A mobile communication device serves as an intermediary between the server and the user. It receives the first portion of the password from the server, generates the second portion, and provides the complete password to the client application. This intermediary mechanism enables secure password management while facilitating access to multiple network resources.
2Ease of operation
If the same password is used for multiple accounts, then ease of operation is improved, but security is compromised
Solution Approach 1:
The system provides self-service password generation through the mobile device application. The application automatically receives the first password portion from the server, generates the second portion, and combines them to create unique passwords for each account. This eliminates the need for users to manually remember multiple passwords while maintaining security through server-side storage of the critical first portion.
3Reliability
If passwords are stored securely, then security is improved, but access complexity increases
Solution Approach 1:
The mobile communication device performs multiple functions: it acts as a secure receiving endpoint for the first password portion, a random number generator for the second portion, and a client application interface for password entry. This multi-functionality reduces the need for separate security devices while maintaining secure password management across multiple network resources.
Data Source
AI summary
An authentication scheme may be used to decide whether to permit access to a user account access to which is controlled by a network resource server. An initial portion of a password is received at a mobile communication device, and a remaining portion of the password is received at a password client installed in or otherwise coupled to the network resource server. The initial portion is communicated from the mobile communication device to the network resource server, where it is passed to the password client, which combines it and the remaining portion to produce a complete password. A value calculated by the password client from the complete password is sent to a password server, which generated the password and sent the initial portion and remaining portion. If the value matches a value calculated by the password server from the complete password in the same manner, authentication has succeeded.