Secure Data Storage with Indistinguishable Output Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems are vulnerable to password cracking techniques such as dictionary and brute force attacks, which can compromise data security when access passwords are systematically attempted.
Innovation Solution
A system and method that separates password entry from storage, where a user-side device generates and communicates an output based on password candidates to a storage-side device, concealing access success until the storage-side device validates the output, and employs an output syntax that makes authorized and unauthorized outputs indistinguishable, forcing attackers to conduct online password checks and increasing the difficulty of unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If passwords are stored and verified locally on the storage device, then access speed is improved, but security is worsened due to vulnerability against offline dictionary and brute force attacks
Solution Approach 1:
The patent introduces an intermediary verification mechanism where the storage device does not directly verify passwords against stored hashes. Instead, it uses a verification function that compares candidate passwords against a reference password stored in a separate, secure location (such as a hardware security module or encrypted storage). This intermediary layer prevents direct offline cracking while maintaining efficient verification through the use of cryptographic comparisons.
Solution Approach 2:
The patent segments the password verification process into distinct components: a secure reference password storage mechanism, a verification function that performs cryptographic comparison, and an access control decision layer. This segmentation isolates the sensitive password verification logic from the main storage system, making it resistant to offline attacks while preserving speed through optimized cryptographic operations.
2Ease of operation
If offline password verification is implemented, then ease of operation is improved, but security is worsened due to ability to conduct dictionary and brute force attacks
Solution Approach 1:
The patent employs an intermediary verification mechanism that prevents direct offline password cracking. The storage device contains a secure verification function that compares candidate passwords against a reference password stored in a protected location (such as a hardware security module). This intermediary layer allows password verification to occur without exposing the reference password to offline attack vectors, while maintaining ease of operation through automated verification.
Solution Approach 2:
The patent converts the potential harm of storing password verification data into a benefit by using the stored reference password as a security anchor. Instead of storing hashed passwords that can be cracked, the system stores a securely protected reference password that must be verified through a controlled process. This transforms the storage function from a vulnerability vector into a security mechanism that prevents offline attacks.
3Reliability
If password verification is performed online only, then security is improved by preventing offline attacks, but productivity is worsened due to increased time required for access attempts
Solution Approach 1:
The patent introduces an intermediary verification function that enables efficient online password verification while preventing offline attacks. The verification function uses cryptographic comparison mechanisms that can rapidly compare candidate passwords against a reference password stored in a secure location. This intermediary layer maintains high verification speed for legitimate access attempts while ensuring that unsuccessful attempts cannot be performed offline, thus balancing security and productivity.
Data Source
AI summary
Various embodiments of systems and methods for securely storing data are provided. In one embodiment, a computer-readable storage module is provided for securely storing data. A storage-side processor is provided for selectively granting access to the stored data on the computer-readable storage module. A user-side memory for storing an output generation record is also provided. A user-side processor configured to provide a password receiving module for receiving a password candidate, an output generation module for using the password candidate received to attempt to access the output generation record and for generating an output based on whether the attempt to access the output generation record is successful, and an output communication module for communicating the output generated by the output generation module to the storage-side processor are also provided. The storage-side processor is configured to grant access to at least some of the data if the output received corresponds to an authorized output, the storage-side processor being configured to otherwise deny access to the data. The user-side processor is further configured to conceal whether the attempt to access the output generation record was successful until the storage-side processor receives the output generated. The output generation module is configured to generate the authorized output if the password candidate is an authorized password and the output generated is not the authorized output if the password candidate is not the authorized password.