Storage Device Password Authentication via Encrypted Credential Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microsoft's IEEE 1667 Password Silo authentication protocol requires devices to store passwords, which is insecure for encrypted data, as it allows unauthorized access and decryption if the device is compromised.
Innovation Solution
A method where the storage device generates a cryptographic key by combining the entered password with a random number, encrypts the password, and stores only the encrypted version, preventing unauthorized access and ensuring secure storage of encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the device stores a copy of the password in non-volatile memory to verify host authentication, then authentication functionality is enabled, but security is compromised allowing unauthorized access if the device is compromised
Solution Approach 1:
The patent extracts the password from the device's storage entirely. Instead of storing the password on the device, only encrypted versions are stored. The actual password resides solely on the host, eliminating the security vulnerability of device-based password storage while maintaining authentication functionality through challenge-response protocols.
Solution Approach 2:
The patent introduces cryptographic hashes and encrypted password versions as intermediaries between the host password and the authentication verification process. These encrypted representations allow the device to verify authentication without ever storing or exposing the actual plaintext password, resolving the contradiction between authentication capability and security.
2Object-affected harmful factors
If the device stores encrypted password versions, then security is improved preventing password recovery, but authentication verification becomes more complex
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing multiple encrypted versions of the password (e.g., different hash algorithms, different encryption keys) during the password setup phase. This allows the authentication process to simply compare the newly computed hash against pre-stored hashes, reducing verification complexity while maintaining strong security through multiple encryption layers.
Data Source
AI summary
A storage device comprises a non-volatile storage media and a processor that is operative to receive, via an interface with one or more host devices, a first entered password needed for accessing data stored in the non-volatile storage media, generate a first number, combine the first entered password and the first number, generate a cryptographic key based on the combination of the first entered password and the first number, encrypt the received first entered password using the cryptographic key, and store the encrypted first entered password and the first number in the non-volatile media. The processor may be further operative to receive a request for authentication; provide a reply comprising the first number; receive a second number calculated based on a cryptographic combination of the first number and a second entered password, and authenticate the host device if the second number successfully decrypts the encrypted first entered password.