Secure Storage System with Two-Level Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional secure storage systems face vulnerabilities due to password exposure during authentication, potential insider tampering, hash collision risks, and reliance on reversible encryption, which compromise data security.
Innovation Solution
A secure storage system employing a crypto engine with a random number generator, hash function, and encryption engines, utilizing two-level password authentication and access gating through an access key generated by a random number generator, without storing the original password, and featuring a storage array with public, secure, and system partitions to enhance security and prevent brute force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password authentication is used in conventional secure storage systems, then user access control is enabled, but password exposure and insider tampering vulnerabilities occur
Solution Approach 1:
The patent extracts the password from the authentication process entirely. Instead of using passwords for authentication, the system uses challenge-response protocols where the authentication device verifies knowledge of the password without ever receiving or storing the password itself. This removes the vulnerable element (password transmission and storage) while maintaining authentication functionality.
Solution Approach 2:
The patent introduces challenge-response protocols as an intermediary mechanism between the user and authentication device. The authentication device generates challenges, the user responds using their password knowledge, and verification occurs through cryptographic proof without exposing the password. This intermediary process eliminates direct password exposure while enabling authentication.
2Object-affected harmful factors
If hash functions are used for password storage, then password exposure is reduced, but hash collision risks remain
Solution Approach 1:
The patent removes the hash function from the authentication process entirely. Instead of hashing passwords for storage and comparison, the system uses challenge-response protocols where the password never leaves the user's device in any form. This eliminates both password exposure and hash collision vulnerabilities by taking out the vulnerable cryptographic processing steps.
3Reliability
If reversible encryption is used for data protection, then data confidentiality is maintained, but insider tampering and key management vulnerabilities occur
Solution Approach 1:
The patent inverts the conventional approach by not encrypting data at all. Instead, it uses authentication protocols that prove knowledge without revealing information. The system verifies user identity through challenge-response mechanisms and uses secret sharing schemes where data can only be reconstructed with sufficient authorized shares, eliminating insider tampering risks while maintaining confidentiality.
4Reliability
If public-key infrastructure and certificate servers are used, then secure key distribution is achieved, but system complexity and dependency on external infrastructure increase
Solution Approach 1:
The patent implements self-service authentication where each user's device independently performs authentication operations using their own secrets and cryptographic keys. The system uses secret sharing schemes where the authentication capability is distributed across multiple shares stored in different locations, eliminating dependency on central certificate servers or key distribution infrastructure while maintaining security.
Data Source
AI summary
A secure storage system is disclosed. The secure storage system comprises a crypto engine and a storage device. The crypto engine comprises a random number generator; a hash function; a general encryption engine; and a data encryption engine. The secure storage system further includes a storage device coupled to the crypto engine. The storage device includes a storage array. The storage array includes a public partition, a secure partition and a system partition. The public partition is accessible to the public. The secure partition is accessible through the password authentication. The system partition is accessible only by the secure storage system. The password authentication is two-level instead of one, to avoid hash collision or insider tampering. The secure partition is accessed with “access gating through access key” instead of “access control through comparison.” The password can be changed without reformatting the secure storage.