Server-Side Authentication via Salt-Derived Strings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional server-based authentication methods are vulnerable to password interception and breaches, as passwords are transmitted in plaintext or obfuscated form, leading to potential access to multiple accounts if a single username and password combination is compromised.
Innovation Solution
Generating a salt on the server and transmitting it to the user device for deriving an authentication string, which is then transmitted back to the server for authentication, ensuring the password remains secure on the user device and only a derivative is stored on the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passwords are transmitted to the server for authentication, then user authentication can be performed, but the password may be intercepted by malicious actors in-transit or accessed through server breaches
Solution Approach 1:
The patent extracts the password from the transmission path between user device and server. Instead of transmitting the actual password, the system transmits only the authentication string (derived from password combined with salt) to the server for verification. This extraction prevents password interception while maintaining authentication functionality.
Solution Approach 2:
The patent introduces an intermediary mechanism where the user device performs password derivation locally using a salt received from the server. The authentication string generated this way serves as an intermediary that proves password knowledge without revealing the password itself during transmission to the server.
2Reliability
If passwords are stored on the server for authentication, then login verification can be performed, but the server breach provides access to user credentials across multiple accounts
Solution Approach 1:
The patent extracts the actual password storage from the server. Instead of storing passwords, the server stores only salts and authentication strings. The password remains extracted and stored only on the user device, preventing server breaches from exposing user credentials.
Solution Approach 2:
The patent segments the authentication data into separate components stored in different locations: salts are stored on the server, while authentication strings are derived locally on the user device. This segmentation ensures that even if the server is breached, the actual password credentials remain protected on the user device.
3Ease of operation
If passwords are reused across multiple systems, then ease of operation is improved, but a single breach compromises multiple accounts
Solution Approach 1:
The patent applies local quality by making each user device's authentication process unique through locally-generated authentication strings. Even though users may reuse passwords across systems, the authentication strings generated on different devices will differ due to the salt and derivation process, providing security isolation.
Solution Approach 2:
The patent enables self-service authentication where the user device autonomously generates authentication strings using locally-stored salts and passwords. This eliminates the need for the server to store actual passwords, allowing users to reuse passwords across systems while maintaining security through local derivation.
Data Source
AI summary
A server may perform server side authentication of a user device. The user device may generate a first authentication string by performing a hash function on a username, a password, and a first salt. The first authentication string may be registered with the server for subsequent login attempts. At login, the user device generates the first authentication string and transmits the first authentication string to the server. When the authentication strings match, the user device is authenticated. The user device may also update the first authentication string. The server may provide the first salt and a second salt to the user device. The user device may generate a first authentication string and a second authentication string from the first salt and the second salt, respectively. When the first authentication strings match, the server may update the user device's authentication string by replacing it with the second authentication string.