Salted Password Authentication with Dynamic Context
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password authentication mechanisms are vulnerable to brute force attacks due to the long lifespan of passwords and the difficulty in changing them frequently, which allows attackers to exploit recovered passwords indefinitely.
Innovation Solution
A method that introduces variability into the secret used for authentication by combining a password with context information that changes frequently, requiring users to enter a first context information at each authentication, which is used to calculate a current fingerprint, thereby increasing the complexity of exhaustive search attacks and enhancing security without significant memorization efforts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a password is stored in encrypted form with a salt and non-invertible function, then security against pre-computation attacks is improved, but exhaustive search attacks remain possible and computationally feasible
Solution Approach 1:
The patent introduces dynamic context information that changes frequently (e.g., based on time, location, or device state) and combines it with the static password to form the authentication secret. This makes the secret dynamic rather than static, so that even if an attacker recovers the password, the changing context information renders the recovered password useless for future authentication attempts without the current context value.
Solution Approach 2:
The patent changes the parameters of the authentication system by introducing context information that varies over time and conditions. The secret is no longer a fixed value but depends on variable parameters (context information) that update frequently, thereby increasing the computational cost and reducing the effectiveness of exhaustive search attacks.
2Ease of operation
If the password lifespan is kept long to reduce user burden, then ease of operation is improved, but security is worsened because attackers can exploit recovered passwords for extended periods
Solution Approach 1:
The patent makes the authentication secret dynamic by incorporating frequently changing context information. This allows the system to maintain long password lifespans for user convenience while effectively limiting the window of opportunity for attackers, since each authentication requires not just the password but also the current context information that changes independently.
3Reliability
If context information is introduced to increase variability and security, then security is improved, but device complexity and user memorization requirements increase
Solution Approach 1:
The patent implements a system where context information is automatically generated or obtained without requiring active user management. The system itself handles the generation, storage, and retrieval of context information, eliminating the need for users to manually manage multiple secrets or remember additional complex information beyond their password.
4Reliability
If context information changes frequently to thwart attacks, then security is improved, but user memorization effort increases
Solution Approach 1:
The system automatically manages context information generation and retrieval, so users do not need to actively remember or manage the changing context values. The context information may be derived from system state, time, or location data that is automatically available, eliminating the memorization burden while maintaining security through frequent changes.
Data Source
Figure 1~2
AI summary
The invention relates to a method for authenticating a user by a verifier, said method comprising: - receiving (E2) a password (w) entered by the user and a first piece of context information (ctx) entered by the user, - calculating (E3) a current fingerprint, by applying a one-way function to the password and to the first piece of context information, - verifying (E4) that the current calculated fingerprint is equal to a reference fingerprint of a secret, calculated during a preceding authentication of the user, the authentication being successful when the current fingerprint is equal to the reference fingerprint.