Server-Specific Credential Generation Against Password Reuse Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of the same password for multiple websites increases vulnerability to user impersonation and man-in-the-middle (MITM) attacks, as existing authentication protocols do not adequately protect against such threats.
Innovation Solution
Implementing per-server customized access credentials by modifying a portion of the obtained access credentials based on identifying information of the protected resource and server, using techniques like hashing, to generate server-specific credentials compliant with format rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the same password is used for multiple websites, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent segments a single master password into multiple server-specific credentials by incorporating server identifying information (such as server name, IP address, or port) into the credential generation process. This allows the user to maintain one master password while each server receives a unique credential, thus improving security without sacrificing ease of operation.
Solution Approach 2:
The patent applies local quality by making credentials server-specific rather than universal. Each credential is customized with local characteristics (server-identifying information) that make it valid only for its intended server, preventing credential reuse across different servers and thereby enhancing security while maintaining user convenience.
2Reliability
If per-server customized credentials are implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent implements self-service by enabling the user device to automatically generate and manage server-specific credentials without requiring server-side modifications or complex infrastructure. The device itself performs the credential customization using embedded logic that incorporates server identifying information, thereby improving security while avoiding increased system complexity.
Solution Approach 2:
The patent changes parameters of the credential (such as incorporating server-specific identifiers like hostname, IP address, or port number) to create unique credentials for each server. This parameter modification approach enhances security through credential differentiation while maintaining relatively simple implementation since it only requires changing credential composition rather than entire authentication systems.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Substantially enhances security by limiting vulnerability to user impersonation and MITM attacks, while being simple to implement without modifying servers or their interfaces.
Implementation Method 1
modifying at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server
Data Source
AI summary
An apparatus comprises at least one processing device that includes a processor coupled to a memory. The processing device is configured to obtain access credentials for accessing a protected resource via a server over a network, to modify at least a portion of the obtained access credentials based at least in part on identifying information of at least one of the protected resource and the server, and to utilize the modified access credentials in place of the obtained access credentials in an authentication protocol carried out with the server. In some embodiments, modifying at least a portion of the obtained access credentials illustratively comprises modifying at least a portion of the obtained access credentials in a manner compliant with one or more credential format rules for the protected resource. The access credentials may comprise at least one of a username and a password.