Password Storage Using Physical Unclonable Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure password storage, such as encryption, are vulnerable to hacking, as a hacked cloud server can compromise all stored passwords, and hashed versions of passwords may still be useful to hackers, posing a significant security risk to users and companies.
Innovation Solution
Implementing a password storage system that utilizes a hardware element called a physical unclonable function (PUF) to generate a unique representation of the password, which is stored and used for verification, making the stored information useless without access to the PUF, and optionally incorporating a fuzzy extractor to enhance verification processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are stored encrypted at a cloud server, then password storage is convenient and accessible, but the security risk increases because a hacked server can compromise all stored passwords
Solution Approach 1:
The password verification process is segmented into two parts: the server stores only the PUF output (not the password itself), and the actual password verification occurs locally in the user's browser using the PUF. This segmentation prevents the server from having access to usable password data, eliminating the risk of mass password compromise while maintaining convenient centralized storage.
Solution Approach 2:
The PUF (Physical Unclonable Function) acts as an intermediary between the password and the server storage. Instead of storing passwords or even hashed passwords directly, the system stores the PUF output which serves as a one-way representation. This intermediary transformation ensures that stored data cannot be reverse-engineered to obtain the original password, resolving the security contradiction.
2Reliability
If hashed versions of passwords are stored, then some security is provided, but hashed passwords can still be useful to hackers for rainbow table attacks
Solution Approach 1:
The traditional cryptographic hashing mechanism is replaced with a physical unclonable function (PUF). Instead of using software-based hash functions that can be cracked with rainbow tables, the system uses a hardware-based PUF that leverages physical manufacturing variations. This substitution makes the verification process resistant to traditional cryptographic attacks while maintaining security.
3Reliability
If passwords are never stored at the server (decentralized credential management), then security is improved, but the system complexity increases and requires client-side encryption/decryption capabilities
Solution Approach 1:
The browser's PUF implementation performs self-service by automatically generating the PUF output from the user's password during verification. The system leverages the browser's existing security infrastructure and the PUF's inherent properties to perform verification without requiring complex client-side key management or encryption libraries, thus reducing overall system complexity while maintaining high security.
Data Source
AI summary
The present disclosure relates to a method and system for secure password storage. In particular, the present disclosure relates to a computer implemented method making use of a hardware element in the form of a physical unclonable function (PUF) and forming a fuzzy version of the password, thus making remote password storage less risky for an end user. The disclosure also relates to a corresponding password storage system and to a computer program product.