Rate-Limited Device-Specific Cryptographic Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing computing power and ease of brute force attacks on cryptographic keys, particularly for short and simple passwords, make user secrets vulnerable, as attackers can quickly generate all possible combinations on powerful devices.
Innovation Solution
A system and method for generating device-specific cryptographic keys through iterative encryption operations based on a device-specific value, limiting the rate at which keys can be generated, using a dedicated hardware encryption engine and unique device identifiers, ensuring that key generation occurs on the specific device and slows down brute force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If brute force attacks are performed on cryptographic keys using powerful computing devices, then the speed of key generation and attack increases, but the security of user secrets deteriorates
Solution Approach 1:
The patent performs preliminary actions by pre-computing iteration counts and storing them in the system before an attack occurs. The iteration register is pre-loaded with values that will be used during key generation, allowing the system to perform rate-limited iterations without real-time computation overhead. This preliminary preparation enables the system to maintain security while managing attack speeds effectively
Solution Approach 2:
The patent implements periodic action through rate-limited iterative key generation. Instead of allowing continuous or rapid key generation attempts, the system performs a fixed number of iterations (stored in the iteration register) for each key generation request. This periodic, limited iteration approach creates deliberate delays that slow down brute force attacks while still enabling legitimate key generation, effectively trading off some speed for improved security
2Reliability
If iterative encryption operations are performed to generate device-specific keys, then security against brute force attacks improves, but the time required for key generation increases
Solution Approach 1:
The patent changes parameters by using device-specific values (such as device identifiers or hardware characteristics) as inputs to the iterative encryption process. This parameter change ensures that each device generates unique cryptographic keys through the same iterative process, providing security without requiring excessive time. The iteration count is also adjusted based on security requirements rather than being fixed, allowing optimization between security and time
Solution Approach 2:
The system performs preliminary actions by pre-determining and storing the iteration count in an iteration register before the actual key generation process. This preliminary setup allows the iterative encryption to proceed with a predetermined number of steps, ensuring adequate security while avoiding unnecessary additional iterations that would waste time. The device-specific parameters are also prepared in advance to streamline the iterative process
Data Source
AI summary
Disclosed herein are systems, methods, and non-transitory computer-readable storage media for generating a device dependent cryptographic key in a rate-limited way. A system configured to practice the method first receives data associated with a user. The data associated with the user can be a password, a personal identification number (PIN), or a hash of the password. Then the system performs a first encryption operation on the user data based on a device-specific value to yield first intermediate data and performs a second encryption operation on the first intermediate data based on the device-specific value to yield second intermediate data. Then the system iteratively repeats the second encryption operation until a threshold is met, wherein each second encryption operation is performed on the second intermediate data from a previous second encryption operation. The iterations produce a final cryptographic key which the system can then output or use for a cryptographic operation.