Segmented Authentication Code Hashing for Matrix Pattern Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Matrix Pattern Authentication (MPA) technologies face issues with insufficient entropy, leading to vulnerabilities in large-scale implementations, where users often select similar patterns, making them susceptible to intelligent guessing, and the processing overhead for authentication is excessively high, rendering them impractical and vulnerable to denial-of-service attacks.
Innovation Solution
The method involves dividing the authentication code into segments, encoding each segment using a one-way hashing function, and storing them separately, with the challenge code also divided into portions to generate candidate patterns, ensuring that each segment is validated sequentially or in parallel, reducing the number of iterations required for authentication and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authentication code is processed as a single unit, then the security is maintained, but the processing overhead becomes excessively high
Solution Approach 1:
The authentication code is divided into multiple segments that are processed independently. Each segment is hashed and validated separately, which reduces the processing overhead compared to processing the entire code as a single unit, while maintaining security through sequential validation requirements.
2Productivity
If the authentication code is divided into segments and processed independently, then the processing overhead is reduced, but the security may be compromised
Solution Approach 1:
The authentication code is segmented into multiple parts that can be processed in parallel or sequentially. Each segment maintains its own hash and validation, allowing independent processing that reduces overhead while the sequential validation requirement ensures security is not compromised.
Solution Approach 2:
The segments are pre-hashied and stored separately before authentication. This preliminary encoding allows for efficient validation during authentication without requiring re-processing of the entire code, reducing processing overhead while maintaining security through the pre-computed hash values.
3Ease of operation
If users select memorable identification patterns, then the ease of operation is improved, but the entropy is reduced making them susceptible to guessing attacks
Solution Approach 1:
The authentication code is divided into segments that can be validated independently. This segmentation allows the system to process memorable patterns more efficiently by validating only the relevant segments, reducing the impact of low entropy while maintaining ease of operation.
Solution Approach 2:
The system changes the validation parameters by using multiple hash functions and sequential validation steps. This transforms the authentication process to better handle memorable patterns, maintaining ease of operation while improving security through enhanced validation parameters.
4Reliability
If the authentication system processes all possible combinations, then the security is improved, but the processing time increases making it vulnerable to denial-of-service attacks
Solution Approach 1:
The authentication process is segmented into independent hash validation steps. Instead of processing all possible combinations, the system validates each segment's hash separately, which dramatically reduces processing time and prevents denial-of-service attacks while maintaining security through the hash validation mechanism.
Solution Approach 2:
The system replaces the mechanical approach of checking all possible combinations with a cryptographic hash-based validation system. This substitution eliminates the need to process all combinations, reducing processing time to minimal levels while maintaining strong security through the properties of hash functions.
Data Source
Figure 1A~2B
Figure 3A~4
Figure 5
AI summary
The invention relates to a method of authentication of a user (U), comprising the steps of: obtaining an authentication code of a user, the authentication code comprising at least six elements based on a memorable identification pattern, MIP, associated with at least one authentication arrangement, dividing the authentication code into at least two authentication segments each forming a subset of the elements of the authentication code (MIP); encoding each of the authentication segments using a one-way hashing function; storing the encoded authentication segments for use in a validation in a database (11); obtaining a challenge code (OTC) from the user, the challenge code being based on a pattern associated with at least one challenge arrangement comprising duplicated signs,and validating the challenge code (OTC) only if each portion of the challenge code (OTC) corresponding to an authentication segments is validated. The invention also relates to a system for performing such a method.