PIN Authentication Scrambling and Exponential Delay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, particularly those relying on personal identification numbers (PINs), are vulnerable to side-channel attacks and provide limited security, especially when PINs are stored in centralized databases or used with smart cards, which can be susceptible to power analysis attacks and card tear techniques.
Innovation Solution
Implementing a method that uses exponential delay mechanisms and scrambled PIN data to protect against side-channel attacks, where unsuccessful PIN attempts result in increasing delay periods and scrambled PIN validation, reducing the effectiveness of power analysis attacks and card tear vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PIN validation is performed directly without scrambling, then the authentication process is simple and fast, but the system becomes vulnerable to side-channel attacks and power analysis attacks
Solution Approach 1:
The patent introduces scrambled PIN data as an intermediary between the user-entered PIN and the validation process. Instead of directly comparing plain PINs, the system stores and validates scrambled versions, adding a protective layer that prevents attackers from analyzing power consumption patterns during direct PIN comparison, thereby resolving the contradiction between security and process simplicity
Solution Approach 2:
The patent transforms the PIN parameter by applying scrambling functions to the stored PIN data. This parameter change ensures that even if power analysis attacks capture intermediate values, the scrambled nature prevents reconstruction of the original PIN, enhancing security without fundamentally changing the authentication flow
2Reliability
If exponential delay is implemented after unsuccessful PIN attempts, then the system becomes resistant to brute-force and card tear attacks, but the user experience deteriorates due to increasing wait times
Solution Approach 1:
The patent implements dynamic delay periods that increase exponentially with each unsuccessful PIN attempt. The delay is not fixed but adapts based on the number of failed attempts, providing strong protection against brute-force attacks while allowing legitimate users to experience minimal delay when entering their PIN correctly on the first or second try
Solution Approach 2:
The system performs preliminary validation checks before applying the full exponential delay. Quick validations occur first, and only when these fail does the system escalate to the full delay mechanism, thereby preventing unnecessary time loss for users while maintaining strong security against automated attacks
3Ease of operation
If centralized database storage of PINs is used, then PIN management is centralized and controllable, but the database becomes a high-value target for attacks and a single point of failure
Solution Approach 1:
The patent introduces scrambled PIN data as an intermediary layer in the centralized database. Instead of storing plain PINs, the system stores scrambled versions that cannot be reverse-engineered through power analysis or other side-channel attacks. This maintains centralized control for management purposes while eliminating the high-value target vulnerability
Solution Approach 2:
The patent creates a composite security structure by combining centralized database storage with scrambled PIN data and exponential delay mechanisms. This composite approach retains the operational benefits of centralized management while layering multiple protective elements that collectively resist various attack vectors
Data Source
AI summary
A method for private personal identification number (PIN) management includes receiving a first PIN, receiving a first key used to scramble a second PIN that has been validated, receiving a first scrambled PIN comprising the second PIN scrambled with the first key, scrambling the first PIN with the first key to create a second scrambled PIN and validating the first PIN based at least in part on whether the first scrambled PIN matches the second scrambled PIN.