Split Derived Credential Key Storage for Mobile Brute Force Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DC management systems for mobile devices lack protection against brute force attacks, as derived credentials are stored entirely within the device, allowing unauthorized access.
Innovation Solution
The solution involves splitting the DC private key into two kibbles, where one kibble is stored on the mobile device and the other on a controller accessible via a communication network, using a user password to create encryption keys, and implementing a proof of knowledge mechanism to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If DC private key is stored entirely within the mobile device, then ease of operation is improved, but security is worsened due to vulnerability to brute force attacks
Solution Approach 1:
The DC private key is segmented into two separate kibbles: the first kibble is stored in the mobile device's secure storage, and the second kibble is stored in a controller accessible via a communication network. This segmentation prevents brute force attacks because an attacker would need to compromise both storage locations simultaneously to obtain the complete private key.
2Reliability
If DC private key is split into two kibbles stored in different locations, then security is improved, but device complexity is worsened
Solution Approach 1:
A controller acting as an intermediary is introduced to manage the second kibble. The controller receives proof of knowledge from the mobile device, validates it against stored values, and conditionally provides the second kibble. This intermediary simplifies the overall system architecture by centralizing security logic while maintaining the benefits of key segmentation.
Solution Approach 2:
The system performs preliminary actions by storing proof of knowledge in the controller before actual authentication is needed. When the mobile device presents the correct password, the controller has already prepared the validation mechanism, enabling fast and secure authentication without complex real-time computations.
3Reliability
If proof of knowledge mechanism is implemented, then security is improved by preventing brute force attacks, but device complexity is worsened
Solution Approach 1:
The controller implements a feedback mechanism by comparing the presented proof of knowledge against stored proof of knowledge values. When the proof matches, the controller provides the second kibble; when it doesn't match, the controller denies access. This feedback loop provides clear security validation without requiring complex cryptographic operations at authentication time.
Data Source
AI summary
At a mobile device, a password is used to create a proof of knowledge (POK). The POK is stored in a controller accessible via a communication network. The POK ensures that the controller can detect an incorrect password from the mobile device, and that the mobile device cannot be subject to a brute force attack to determine the DC stored in the mobile device. After a predetermined number of unsuccessful attempts to enter the password, the controller blocks further attempts, thereby restoring protection against a brute force attack that was lost going from a standalone smart card to mobile-device-based derived credentials. A portion of Derived Credentials, needed to authenticate the user of a mobile device, is stored in the controller, further increasing the difficulty of unauthorized use.