Public Key Cryptography Authentication via Hardware Security Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional username-password authentication methods are insecure due to password storage risks and user burden, especially in large-scale systems with high turnover rates, requiring improvements in user authentication for secure access control.
Innovation Solution
Implementing secure remote user authentication using public key cryptography and key splitting, which eliminates the need for complex passwords by splitting the private key into fragments stored on both the user's device and a server-side identity service, allowing secure login without password reliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional username-password authentication is used, then ease of operation is maintained, but security is compromised due to password storage risks and vulnerability to hacking
Solution Approach 1:
The private key is segmented into multiple key fragments distributed across different locations (user's mobile device, server, and hardware security module). This segmentation eliminates the need for password storage while maintaining security, as no single fragment alone can compromise the authentication system.
Solution Approach 2:
The mechanical password-based authentication system is replaced with a cryptographic key-based system. Instead of relying on users to manage complex passwords, the system uses public key cryptography where the private key fragments are automatically managed through cryptographic operations, eliminating password management burdens.
2Ease of operation
If passwords are stored on the host for authentication, then ease of operation is improved, but security is worsened due to risk of compromise by hackers
Solution Approach 1:
The authentication system extracts and removes the password component entirely, replacing it with cryptographic key fragments. The private key fragments are stored securely in distributed locations rather than being centralized in a password database, eliminating the vulnerability to password database breaches.
Solution Approach 2:
A hardware security module acts as an intermediary that securely stores and manages the private key fragments. This intermediary protects the key fragments from direct access and potential compromise, while still enabling authentication operations through cryptographic verification.
3Reliability
If complex passwords are required for security, then authentication security is improved, but ease of operation deteriorates due to difficulty in remembering and managing passwords
Solution Approach 1:
The system provides self-service through automatic key fragment management. Instead of requiring users to manually create, remember, and manage complex passwords, the system automatically generates and manages cryptographic key fragments, performing security functions that would otherwise be burdensome for users.
4Adaptability or versatility
If password rotation is enforced for compliance, then security policy compliance is improved, but system security deteriorates due to weakened passwords from frequent changes
Solution Approach 1:
The authentication system changes the fundamental parameter from password-based authentication to cryptographic key-based authentication. This parameter change allows for flexible compliance with security policies while maintaining strong security, as cryptographic keys do not require rotation in the same way passwords do and are not vulnerable to weakening from frequent changes.
Data Source
AI summary
In a computing system, methods for secure OS level login authentication for internal users to access servers. Some or all servers in a group each utilize a local ID Service for generating and validating a challenge responsive to an OS login request. The challenge is processed in a centralized secure server HSM. Rather than copying individual user public keys to each host in the data center, we need only copy the public key of the HSM to each host in the group. When a user attempts OS level login to a host, it encrypts the challenge using the public key of the HSM and forwards the request for processing in the HSM. There, it decrypts the challenge using the private key in the HSM and re-encrypts the challenge with the public key of the individual user. The user's mobile device, previously registered, is required to complete the authentication process.