Key Handle Password Authentication With Secure Processor Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password authentication systems are vulnerable to dictionary and rainbow table-based attacks, and the use of salts does not adequately protect against sophisticated attackers with significant computing power, leading to potential password compromise.
Innovation Solution
Implementing a cryptographic key handle-based authentication system where the key handle references a cryptographic key stored in a security processor, ensuring the key is not exposed outside and using a keyed-hashing algorithm to verify passwords, thus preventing unauthorized access and protecting the underlying password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passwords are stored in authentication records, then user identity verification is enabled, but the system becomes vulnerable to dictionary and rainbow table attacks
Solution Approach 1:
The patent introduces a cryptographic key handle as an intermediary between the password and the authentication record. Instead of storing the password directly or using a simple hash, the system stores a key handle that references a cryptographic key in a security processor. This intermediary layer prevents direct exposure of the password while enabling authentication, thereby resolving the contradiction between enabling user identity verification and preventing dictionary/rainbow table attacks.
Solution Approach 2:
The patent replaces traditional mechanical password storage mechanisms with a cryptographic key-based system. Instead of storing passwords or simple hashes in authentication records, the system uses cryptographic keys stored in a security processor (such as a TPM or HSM) to derive authentication values. This substitution elevates the security mechanism from simple text storage to cryptographic operations, effectively preventing dictionary and rainbow table attacks while maintaining authentication functionality.
2Reliability
If salts are used to protect passwords, then some security protection is provided, but sophisticated attackers with significant computing power can still compromise passwords
Solution Approach 1:
The cryptographic key handle serves as a sophisticated intermediary that prevents even sophisticated attackers from directly accessing or brute-forcing passwords. The key handle references a cryptographic key stored in a secure hardware environment, adding an additional layer of security that goes beyond simple salting. This intermediary mechanism ensures that even with significant computing power, attackers cannot compromise passwords through dictionary or rainbow table attacks.
Solution Approach 2:
The patent replaces the insufficient salting mechanism with a cryptographic key-based system stored in a security processor. This substitution provides stronger protection against sophisticated attackers by using hardware-based cryptographic operations and secure key storage, making password compromise infeasible even with significant computing resources.
3Ease of operation
If cryptographic keys are stored outside the security processor, then key accessibility is improved, but the key becomes exposed and vulnerable to attacks
Solution Approach 1:
The key handle acts as an intermediary that provides key accessibility without exposing the actual cryptographic key. The authentication system stores and references the key handle, which can be used to access the key through the security processor's controlled interface. This intermediary mechanism enables necessary key accessibility for authentication operations while preventing key exposure to external systems, thereby resolving the contradiction between ease of operation and security.
Data Source
AI summary
A process includes receiving credentials associated with a request to access a computer platform. The credentials include a password and a user identification. The process includes determining a key handle and a reference cryptographic digest corresponding to the user identification. The process includes determining a second cryptographic digest corresponding to the user identification. Determining the second cryptographic digest includes providing the key handle and the password to a security processor of the computer platform and initiating an operation by the security processor to apply a keyed-hashing function to the password based on a cryptographic key corresponding to the key handle to provide the second cryptographic digest. The security processor stores the cryptographic key. The process includes regulating access to the computer platform based on a comparison of the second cryptographic digest to the reference cryptographic digest.