Password-less Login via Segmented Key Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password-based security systems for online access are vulnerable to phishing, key-logging, and hacking, and users face the burden of managing multiple complex passwords, making them impractical and insecure.
Innovation Solution
A system that enables access to user profiles without passwords by using a QR-code scan and human gestures on a mobile device, where a cryptographic key is split and distributed among devices using a secret splitting algorithm, ensuring no complete key is stored on any physical device, thereby reducing the risk of compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based security is used to protect user profiles, then access control is provided, but the system becomes vulnerable to phishing, key-logging, and hacking attacks
Solution Approach 1:
The cryptographic key is divided into multiple segments and distributed across different devices (mobile device, server, enabling device). No single device holds the complete key, making the system resistant to attacks targeting any individual component. This segmentation directly addresses the vulnerability to phishing and hacking by eliminating the single point of failure that passwords represent.
Solution Approach 2:
An enabling device acts as an intermediary between the user and the server for authentication. Instead of directly comparing passwords on the server, the enabling device mediates the authentication process by verifying gestures and facilitating key reconstitution. This intermediary layer protects against key-logging and phishing attacks by removing the need for traditional password input fields and direct credential transmission.
2Reliability
If users memorize and protect multiple complex passwords, then account security is improved, but user burden and confusion increase
Solution Approach 1:
The mobile device serves itself as both the user interface and the secure key storage. The device uses its existing sensors (camera for QR scanning, motion sensors for gesture recognition) to perform authentication functions without requiring additional hardware or complex user actions. This self-service approach eliminates the burden of managing multiple passwords while maintaining security.
Solution Approach 2:
The authentication parameter changes from static passwords to dynamic gestures. Instead of requiring users to memorize complex string sequences, the system accepts physical gestures (swipes, taps, patterns) that are easier to remember and execute. This parameter change maintains security through cryptographic key reconstitution while dramatically improving ease of operation.
3Ease of operation
If cryptographic keys are stored at endpoint devices, then access control is enabled, but the system becomes vulnerable to hacking and compromise
Solution Approach 1:
The cryptographic key is segmented into multiple parts and distributed across different locations (server stores some segments, mobile device stores others, enabling device holds reconstruction logic). This segmentation ensures that even if one endpoint is compromised, the complete key cannot be reconstructed, directly addressing the vulnerability to hacking while maintaining access control functionality.
Solution Approach 2:
The system implements temporary key storage with automatic discarding. Cryptographic keys are reconstructed only when needed for authentication, used briefly to enable access, and then discarded. This transient storage approach minimizes the window of vulnerability to hacking while enabling necessary access control operations.
Data Source
AI summary
User profiles stored on a server control access to private data. Access control to the user profiles themselves is provided without a password. In more detail, the user profile is functionally handicapped by at least a portion of digital data (or a cryptographic key) associated with the user profile being removed and discarded after being sent to an enabling device. A human gesture from the user first provides a key to reconstitute the key or restore the missing data portion in the enabling device which is then transmitted to the server to reconstitute the key or restore the missing data portion in order to reconstitute the user profile for access.