Probabilistic Authentication via Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems relying on static credentials, such as passwords, are vulnerable to attacks and compromise security due to their deterministic nature, which limits their ability to handle probabilistic authentication effectively, especially when storing and verifying credentials on the back end.
Innovation Solution
A system and method for strengthening a static credential for probabilistic authentication by splitting it amongst multiple servers, adding randomness, and using one-way functions to derive a strengthened shared secret, ensuring that less than the total number of elements does not leak the secret, even if one server is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a static credential is used for authentication, then the authentication process is simple and deterministic, but the system becomes vulnerable to attacks such as sniffing, key logging, phishing, and man-in-the-middle
Solution Approach 1:
The patent transforms static credentials into dynamic probabilistic credentials by introducing randomness into the authentication process. The system uses random challenges and probabilistic responses that change with each authentication attempt, making the credential behavior dynamic rather than fixed. This resolves the contradiction by maintaining operational simplicity while eliminating determinism that enables attacks.
Solution Approach 2:
The patent changes the fundamental parameters of authentication from deterministic to probabilistic. Instead of requiring exact matches of static credentials, the system uses probabilistic matching where the outcome is based on statistical likelihood. This parameter change maintains ease of operation while significantly improving security by making credentials resistant to sniffing, key logging, and other attacks.
2Device complexity
If the shared secret is stored on a single server, then the system structure is simple, but compromise of that server compromises the entire authentication security
Solution Approach 1:
The patent applies segmentation by dividing the shared secret into multiple separate components stored on different servers. Instead of storing the complete credential on a single server, the system fragments the secret across multiple servers, so that compromise of one server does not compromise the entire authentication security. This segmentation maintains reasonable system structure while dramatically improving security resilience.
3Reliability
If probabilistic authentication is implemented, then front-end security against phishing and man-in-the-browser is improved, but back-end credential storage and verification becomes more complex
Solution Approach 1:
The patent segments the back-end processing by separating credential storage functions across multiple servers. This distribution simplifies the individual processing burden on each server while maintaining the overall probabilistic authentication capability. The segmentation allows front-end security improvements without proportionally increasing back-end complexity.
Solution Approach 2:
The patent introduces an intermediary layer in the credential verification process that simplifies back-end processing. This intermediary mechanism handles the probabilistic matching logic, allowing the back-end to verify credentials without complex processing. The intermediary abstracts the complexity while maintaining front-end security benefits.
Data Source
AI summary
A party can authenticate itself by interacting with multiple servers without revealing the shared secret to any of the involved parties. The stored shared secret is strengthened and broken into shares and saved on the servers. The shared secret is safe against offline brute force attack unless all servers where the shares are stored are compromised. The compromise of any single server, or multiple servers—but less than the maximum number—will not allow the attacker to do a brute force analysis on the shared secret. This back end security enhancement is suitable for probabilistic front end authentication algorithms.