Passwordless Authentication via Challenge-Response Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access protocols for limited access networks are vulnerable to attacks due to easily guessable and reused user IDs and passwords, inadequate password changes, transmission over unsecure channels, and storage in insecure locations, lacking user-friendly complexity and requiring specific hardware for biometric solutions.
Innovation Solution
A secure login protocol that involves a server-controlled value, user ID encryption, and a challenge-response mechanism using a user key, where a server random number is encrypted and decrypted to confirm user identity without transmitting actual passwords, allowing for secure access without the need for specific hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional password-based authentication is used, then ease of operation is improved, but security is worsened due to easily guessable and reused passwords
Solution Approach 1:
The patent extracts the password from the authentication process entirely. Instead of transmitting or storing passwords, the system uses public-private key pairs where the private key remains on the user's device and never leaves it. The authentication is performed using the public key and a challenge-response mechanism, completely removing the vulnerable password element from the system.
Solution Approach 2:
The patent introduces an intermediary cryptographic mechanism (challenge-response protocol with public keys) between the user and the server. The server generates a random challenge, the user's device signs it with the private key, and the server verifies the signature using the public key. This intermediary process eliminates the need for direct password transmission while maintaining authentication functionality.
2Reliability
If passwords are made more complex to resist guessing, then security is improved, but ease of operation is worsened due to user burden
Solution Approach 1:
The patent replaces the mechanical system of human memory and password management with cryptographic algorithms and automated key management. Instead of relying on users to remember complex passwords, the system uses public-private key cryptography where the private key is automatically managed by the user's device and the public key is stored on the server, eliminating the need for user memory while maintaining strong security.
3Ease of operation
If passwords are transmitted over communication channels, then authentication functionality is achieved, but security is worsened due to interception vulnerability
Solution Approach 1:
The patent extracts the secret credential (password) from the communication channel entirely. Authentication is performed using public keys that can be safely transmitted and stored on the server, while the private key never leaves the user's device. The challenge-response protocol ensures that even during communication, no secret information is transmitted, only public verification data.
4Productivity
If lookup tables of user credentials are stored on servers, then authentication speed is improved, but security is worsened due to theft risk
Solution Approach 1:
The patent extracts the secret credential storage from the server environment. Instead of storing passwords or hashed passwords on the server, only public keys are stored. The private keys remain exclusively on user devices, so even if the server is compromised, attackers cannot obtain authentication credentials. The lookup table contains only public verification data, not secret credentials.
Data Source
AI summary
A process is disclosed for authorizing a user's access to a limited access network. The process comprises sending an encrypted server random number to a previously registered user. If the user can demonstrate an ability to successfully decrypt the server random number, the user is authenticated and access is authorized.The process further comprises an encrypted user random number. Encryption of the user random number comprises the use of a server-controlled value. The web server's ability to return to the user a decryption of the encrypted user random number serves as confirmation that the web site is legitimate.In a preferred embodiment all communications of login values between the user and the web server are encrypted.In an embodiment a user is provided with a key for encrypting user random numbers and for decrypting server random numbers. The key may be automatically updated on a predetermined schedule.