Secure Data Storage System Using Segmented Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data stored for authentication purposes, such as biometric data, is susceptible to malicious attacks when stored in plain text, and encryption alone is insufficient as an attacker can gain access to the encryption key, compromising the data.
Innovation Solution
A secure storage system is implemented involving a client device, a server, and a third-party authority, where the server generates an encryption key and a salt, and the third-party authority uses this key to encrypt and decrypt user data, while the server only stores encrypted data, preventing access to the decryption key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data is stored as plain text, then data can be changed if stolen, but data is susceptible to malicious attacks and theft
Solution Approach 1:
The system segments the authentication data into two parts: a static password stored on the server and a dynamic biometric component stored locally on the user's device. This segmentation allows the password to remain changeable while the biometric data provides secure, unchangeable authentication that cannot be stolen in plain text form.
Solution Approach 2:
The system introduces an intermediary authentication mechanism that combines the stored password with real-time biometric verification. The server stores only the password hash, while the client device performs biometric verification locally, acting as an intermediary that prevents direct exposure of sensitive data to potential attackers.
2Ease of operation
If biometric data is stored as plain text, then authentication can be performed, but data cannot be changed if stolen
Solution Approach 1:
The system segments authentication into two independent components: a static password that can be changed and stored on the server, and a dynamic biometric component that remains on the user's device. This allows the password to be modified if compromised while the biometric data provides permanent, unchangeable authentication that never leaves the user's device in transmittable form.
Solution Approach 2:
Instead of storing biometric data on the server for comparison, the system inverts the approach by storing the password on the server and performing biometric verification locally on the user's device. This reversal prevents the server from ever receiving or storing raw biometric data, eliminating the risk of biometric data theft while maintaining authentication capability.
3Object-affected harmful factors
If data is encrypted, then data security is improved, but access to encryption key compromises the entire database
Solution Approach 1:
The system segments the authentication process into client-side and server-side operations. The server stores only password hashes without encryption keys, while the client device performs local biometric verification and generates dynamic authentication tokens. This segmentation eliminates the need for the server to manage encryption keys, preventing key compromise while maintaining data security.
Solution Approach 2:
The system introduces dynamic authentication tokens as an intermediary between the stored password and the authentication verification. These tokens are generated client-side based on biometric verification and the stored password, allowing secure authentication without requiring the server to hold or manage encryption keys that could be compromised.
Data Source
AI summary
A computer program product for secure data storage. The present invention may include completing a registration process by sending, by the client device, a connection request to the server. The present invention may include generating, by the server, an authentication session identification (ID). The present invention may include sending, by the server, a stored salt and the generated authentication session ID to the client device. The present invention may include sending, by the server, the generated authentication session ID, the server encryption key and user data to the third-party device. The present invention may include sending, by the client device, the generated authentication session ID and user data to the third-party device. The present invention may include generating, by the third-party device, a decryption key. The present invention may include determining the user data received by the client device and the decrypted user data received by the server is authenticated.