Secure Distributed Authentication Data System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to data breaches and theft, as they often store and handle authentication credentials insecurely, leading to potential cascading effects across multiple accounts and networks.
Innovation Solution
A secure authentication system that generates a non-restorable digital representation of user authentication data, encrypts it with a key created on each request, and splits the encrypted data across multiple storage resources, ensuring that the original data and encryption key are never stored or transferred, thus protecting them from exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication data is stored in an unencrypted manner on hard drives or in databases, then access and verification are simple and fast, but the data becomes vulnerable to data breaches or theft
Solution Approach 1:
The authentication data is divided into two separate components: the original unencrypted data stored with the resource, and an encrypted copy stored with the authentication server. This segmentation allows the system to maintain simplicity for resource access while implementing security for data protection.
Solution Approach 2:
An authentication server acts as an intermediary between the resource and the user. The server handles the encryption and verification processes, allowing the resource to maintain simple access mechanisms while the server provides secure data handling through cryptographic operations.
2Reliability
If authentication data is encrypted and stored on a single server, then data security is improved, but the system becomes vulnerable to attacks targeting that single server
Solution Approach 1:
The encrypted authentication data is divided into multiple data portions that are distributed across multiple authentication servers. This segmentation eliminates the single point of failure vulnerability while maintaining security, as an attacker would need to compromise multiple servers simultaneously to access the data.
3Productivity
If encryption keys are stored in the memory of the authentication service, then decryption operations are fast and simple, but the keys become vulnerable to theft or exposure
Solution Approach 1:
The encryption key is extracted from the authentication service's memory and stored separately with the encrypted authentication data on the authentication server. This separation eliminates the vulnerability of storing keys in memory while maintaining the ability to decrypt data when needed through proper authentication.
Solution Approach 2:
The system uses temporary session keys that are generated for each authentication session and discarded afterward. These short-living keys provide sufficient security for the duration of the session without the long-term storage vulnerabilities associated with persistent key management.
4Ease of operation
If the same authentication credentials are used for multiple accounts or networks, then ease of use is improved, but a breach in one account can have cascading effects on other accounts
Solution Approach 1:
The authentication data is segmented and encrypted separately for each account or network. Each account has its own encrypted authentication data stored with its specific resource, preventing cascading breaches. Users can maintain the convenience of using similar authentication patterns while each account remains security-isolated through individual encryption.
Data Source
AI summary
Disclosed embodiments relate to systems and methods for secure distributed authentication data. Techniques include identifying asserted authentication data associated with the request, generating an encryption key based on the asserted authentication data, generating a non-restorable digital representation of the asserted authentication data, retrieving an encrypted non-restorable digital representation of authentication data associated with the client identity, decrypting the retrieved encrypted non-restorable digital representation of authentication data using the encryption key, comparing the decrypted non-restorable digital representation of authentication data to the non-restorable digital representation of asserted authentication data; and providing a token for use in an authentication process for the client identity upon determining, based on a match between the stored non-restorable digital representation of authentication data and the non-restorable digital representation of version of the asserted authentication data.