Remote Blind Hashing for Password Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password authentication systems are vulnerable to attacks, particularly 'dictionary attacks' and offline attacks, due to the use of weak passwords and the ability of attackers to steal usernames and password digests, which can compromise user accounts.
Innovation Solution
The implementation of a blind hashing system using a huge block of random data, where a blind hashing device or server accesses this data to generate unique salts and digests, making it difficult for attackers to exploit password weaknesses by using a pseudorandom sequence that is either retained or destroyed, and using multiple iterations of data block lookups to increase security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password authentication is used with stored passwords, then user login is simple and fast, but the system becomes vulnerable to dictionary attacks and offline attacks
Solution Approach 1:
The patent extracts the password storage function from the authentication system by using blind hashing. Instead of storing passwords locally, the system uses a remote blind hashing service that generates unique hashes without revealing the actual passwords or their storage location, thereby removing the vulnerability source while maintaining authentication functionality
Solution Approach 2:
The patent introduces a blind hashing service as an intermediary between the client and the hash storage. This intermediary generates hashes using a remote random data block, preventing direct access to password storage and blocking attackers from performing offline attacks on stolen data
2Object-affected harmful factors
If passwords are hashed and stored, then password theft is mitigated, but matching digests can still be identified and exploited by attackers
Solution Approach 1:
The patent applies local quality by ensuring each password hash is uniquely tied to its specific random data block extent. Even if two passwords are identical, their hashes differ because they are derived from different random data blocks, preventing attackers from identifying matching digests across different accounts
Solution Approach 2:
The patent changes the parameters of hash generation by incorporating remote random data blocks as inputs. This transforms the hashing process from a deterministic function to one that produces unique, non-reproducible outputs, making stolen hashes useless for attacking other accounts
3Reliability
If a remote blind hashing system is implemented, then account security is significantly improved, but the system complexity and data storage requirements increase
Solution Approach 1:
The patent implements universality by creating a centralized blind hashing service that can be shared across multiple authentication systems and applications. The random data block serves universal purposes for generating secure hashes for different users and systems, reducing overall complexity despite the enhanced security features
Data Source
AI summary
A remote data protection network provides a blind hashing service. A blind hashing server receives a message such as a digest from a client, and uses the message to derive a set of indices or offsets into a huge block of random data that is maintained by the remote data protection network. The corresponding extents of data in the block are combined, e.g. using a hash or HMAC function, and then returned to the invoking client, e.g. as a salt. The message and response may be salted with a unique client salt.