Proof of Knowledge Privacy via Distributed Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Proof of Knowledge (PoK) mechanisms lack sufficient security and privacy, as the entity controlling access to secured services often possesses knowledge of all authentication components, increasing the risk of misuse by third parties.
Innovation Solution
A system where a client device receives encryption keys from both a PoK server and a Relying Party (RP) server, decrypts encrypted PoK tests, and encrypts answers, ensuring that neither server has access to all necessary keys, thus isolating sensitive information to the client device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the Relying Party (RP) possesses knowledge of all authentication components (username, password, picture, cognitive test, and answer), then authentication effectiveness is improved, but security and privacy deteriorate due to increased risk of misuse by third parties
Solution Approach 1:
The patent segments authentication knowledge into multiple components distributed across different entities: the RP knows the username and verification data, while the user's client device holds encrypted authentication data (password, picture, cognitive test answers) that can only be decrypted with keys stored locally. This segmentation ensures that no single entity possesses complete authentication knowledge, thereby maintaining authentication effectiveness while reducing security risks from centralized knowledge storage.
2Object-affected harmful factors
If a PoK service is introduced to separate username and password knowledge between RP and PoK service, then security is improved, but privacy deteriorates because the PoK service still possesses authentication knowledge that could be misused
Solution Approach 1:
The patent extracts authentication knowledge (encrypted password, picture, cognitive test answers) from centralized PoK service storage and places it exclusively in the user's client device. The PoK service no longer retains decryption keys or ability to access authentication knowledge - it only provides encrypted data and verification services. This extraction eliminates the privacy risk associated with PoK service knowledge while maintaining security benefits.
3Loss of information
If encryption keys are stored on the client device for decrypting PoK tests, then privacy is improved, but device complexity increases
Solution Approach 1:
The patent implements self-service by enabling the client device to autonomously generate, store, and manage its own encryption keys for protecting authentication data. The device independently performs encryption of authentication knowledge and decryption during authentication without requiring external key management infrastructure. This self-service approach enhances privacy while avoiding the complexity of centralized key management systems.
Data Source
AI summary
Embodiments described herein relate to securing the privacy of knowledge used to authenticate a user (i.e., Proof of Knowledge (PoK) test(s)). In some embodiments, a client device is operable to receive a first encryption key and encrypted test(s) from a PoK server. The client device also receives a second encryption key from a Relying Party (RP) server. The client device can decrypt the encrypted test(s) by using the first encryption key and the second encryption key to thereby render decrypted test(s). The client device is further operable to obtain answer(s) for the decrypted test(s), send a communication to the PoK server based on the answer(s), and receive a communication from the RP server that authorizes a user of the client device to access service(s) administered by the RP server.