Public-Private Key Account Login Authentication System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password-based authentication systems are vulnerable to security concerns such as dictionary attacks, brute force attacks, keylogging, phishing, and social engineering, as well as server compromises, which can lead to unauthorized access and compromised user accounts.
Innovation Solution
Implementing public-private key cryptography for account login authentication, where a user device generates a public-private key pair, with the public key registered and the private key used to decrypt a challenge encrypted by the public key, ensuring secure storage and transmission only of the public key, thus preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used, then account login is simple and straightforward, but security is compromised due to vulnerabilities like dictionary attacks, brute force attacks, keylogging, phishing, and server compromises
Solution Approach 1:
The patent replaces the mechanical/password-based authentication system with a cryptographic system using public-private key pairs. Instead of relying on secret passwords that can be stolen through keylogging or phishing, the system uses mathematical cryptography where the private key never leaves the user's device and the public key cannot be used to derive the private key, thereby substituting a vulnerable mechanical system with a more secure cryptographic one
Solution Approach 2:
The authentication credentials are segmented into two separate keys: a private key that remains securely stored on the user's device and a public key that is stored on the server. This segmentation ensures that even if the server is compromised, the private key cannot be extracted, and if the public key is stolen, it cannot be used to derive the private key or forge authentication
2Reliability
If the user's password is stored on the account provider's server, then authentication is convenient, but security is compromised if the server is compromised
Solution Approach 1:
The patent extracts the critical secret (private key) from the server environment and places it exclusively on the user's device. The server only stores the public key, which is mathematically one-way and cannot be used to derive the private key. This extraction eliminates the security vulnerability of storing sensitive authentication credentials on potentially compromised servers while maintaining authentication functionality
3Reliability
If passwords are used for authentication, then the system is easy to operate, but the system is vulnerable to keylogging software and malware on the user's device
Solution Approach 1:
The patent replaces the password entry mechanism with a cryptographic key pair mechanism. Instead of typing passwords that can be captured by keylogging software, the system uses automated cryptographic operations where the private key is programmatically used to sign authentication challenges, eliminating the vulnerability to keylogging while managing complexity through software automation
Data Source
AI summary
Embodiments of the invention provide improved account authentication using public-private key cryptography instead of passwords. Instead of registering a password and using that password to login to an account, an authentication server of an account provider registers a public key received from a user device. To authenticate the user device for logging into an account, the authentication server generates a challenge and encrypts using the registered public key. The encrypted challenge is sent to the user device, which can decrypt the challenge using the private key corresponding to the registered public key. The decrypted challenge is used for authentication instead of using a password. The private key corresponding to the public key is securely stored and not revealed to the authentication server.