Split Private Key Asymmetric Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptosystems face challenges in providing robust multi-factor authentication while avoiding the vulnerabilities of password storage and transmission, such as single point of compromise and Man-In-The-Middle attacks, and require efficient key distribution and revocation mechanisms.
Innovation Solution
A multi-factor asymmetric key pair system with a split private key, where the private key is divided into multiple portions, each based on different factors, including a user password, and a password-based key derivation function is used to generate these portions, ensuring secure authentication without storing the password on the server and protecting against dictionary attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passwords are stored on the server in a table, then authentication can be performed, but the system becomes vulnerable to single point of compromise and Man-In-The-Middle attacks
Solution Approach 1:
The patent segments the authentication system into multiple components: the server stores only the public key and authentication protocol, while the user's private key remains distributed across multiple devices or storage locations. This segmentation eliminates the single point of compromise by ensuring that no single location contains both the private key and the ability to verify authentication, thereby preventing both server-side breaches and Man-In-The-Middle attacks.
Solution Approach 2:
The patent introduces cryptographic protocols and key derivation functions as intermediaries between the user's password and the server's verification process. Instead of directly storing or transmitting passwords, the system uses public key cryptography and key derivation functions to mediate the authentication process, ensuring that passwords never traverse the network in clear text and cannot be reconstructed from server-side storage.
2Ease of operation
If passwords are transmitted in clear text, then authentication can be performed, but the system becomes vulnerable to eavesdropping and Man-In-The-Middle attacks
Solution Approach 1:
The patent replaces the mechanical approach of transmitting passwords in clear text with a cryptographic system based on public key infrastructure. Instead of directly sending passwords over the network, the system uses public key encryption and key derivation functions to authenticate users, substituting the simple but vulnerable mechanical transmission with a more complex but secure cryptographic mechanism.
3Adaptability or versatility
If a single private key is used, then authentication is simple, but the system lacks multi-factor authentication capabilities
Solution Approach 1:
The patent segments the private key into multiple portions or factors that can be distributed across different devices, storage media, or authentication mechanisms. This segmentation enables multi-factor authentication while maintaining the mathematical properties needed for cryptographic operations, as the system can require multiple key portions to be present simultaneously for successful authentication.
Solution Approach 2:
The patent creates a composite key structure that combines multiple authentication factors into a unified cryptographic system. Rather than using separate authentication mechanisms, the system integrates multiple factors into a single composite key structure that leverages the strengths of each factor while providing a unified authentication interface.
4Reliability
If complex key distribution mechanisms are implemented, then security is improved, but hardware costs and infrastructure complexity increase
Solution Approach 1:
The patent enables users to generate and manage their own key pairs and authentication credentials without requiring complex centralized key distribution infrastructure. The system provides self-service capabilities where users can autonomously create their cryptographic identities, manage their key portions, and perform authentication operations, thereby eliminating the need for expensive and complex hardware-based key distribution systems.
Data Source
AI summary
Techniques for generating a multi-factor asymmetric key pair having a public key and split private key with multiple private portions, at least one of the multiple portions being a multiple factor private key portion, are provided. First and second asymmetric key pairs are generated, each having a private key and a public key. A text string and the first private key are cryptographically combined to make a first private key portion of the split private key. This first private key portion is a multiple factor private key portion. A second private key portion of the split private key is generated based upon the generated first private key portion and the second private key.