Privacy-Preserving Authentication via Cryptographic Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods reveal private user information to servers, making users vulnerable to unauthorized access and impersonation, as they require registering sensitive answers that can be exploited by malicious parties.
Innovation Solution
A device generates authentication hashes through polynomial interpolation of user responses to private questions, allowing secure authentication without revealing the answers to the server, ensuring user privacy by using one-way cryptographic functions and noisy interpolation algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users register private answers with the server for authentication, then authentication functionality is enabled, but user privacy is compromised and vulnerability to unauthorized access increases
Solution Approach 1:
The patent extracts only the essential authentication capability from the private answers, storing them locally on the user's device rather than on the server. The server receives and processes only cryptographic hashes of these answers, not the answers themselves, thereby separating the authentication function from the private information storage.
Solution Approach 2:
The patent introduces cryptographic hashing as an intermediary transformation layer. Private answers are converted into cryptographic hashes before being transmitted to or stored on the server. This intermediary process ensures that the server never handles or stores the actual private information, only its irreversible hash representation.
2Measurement precision
If the server stores private answers for verification, then authentication accuracy is improved, but security against malicious access deteriorates
Solution Approach 1:
The patent converts the potentially harmful storage of private answers on the server into a beneficial security feature by using cryptographic hashing. The hashing process transforms sensitive data into an irreversible format that maintains authentication accuracy while eliminating security vulnerabilities associated with storing plain-text private information.
Solution Approach 2:
The patent replaces the mechanical approach of storing and comparing plain-text answers with a cryptographic system. Instead of directly storing and verifying private answers, the system uses cryptographic hash functions to transform and verify authentication data, substituting a secure computational mechanism for the vulnerable storage approach.
3Loss of information
If cryptographic hashes are used instead of storing private answers, then user privacy is protected, but authentication complexity increases
Solution Approach 1:
The patent implements self-service by enabling the user's device to autonomously generate and store cryptographic hashes of private answers locally. The device performs the hashing operation itself without requiring complex server-side infrastructure, distributing the computational burden to the user's device and simplifying the overall system architecture.
Data Source
Figure 1(a)
Figure 1(b)
Figure 2(a)
AI summary
Example implementations described herein are directed to authentication based on the user's private factors, while not revealing at the server side information allowing the server (or anyone with the server's information) to deduce the private answers. In example implementations, the user answers a questionnaire with authentication factors, wherein the answers are transformed in a one-way fashion and the transformed answers are provided to the server side. Example implementations facilitate authentication based on polynomial interpolation or other methods to permit a user to authenticate, even if the user does not answer all of the questions correctly.