Threshold Password Authentication for Breach-Resistant Token Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token-based authentication systems are vulnerable to server breaches, which can compromise long-term keys and user credentials, leading to potential unauthorized access and offline dictionary attacks.
Innovation Solution
Implement a Password-based Threshold Authentication (PbTA) protocol that distributes the role of the authentication server among multiple servers, requiring a threshold number of servers to authenticate clients and generate tokens, ensuring that even if some servers are compromised, valid tokens cannot be forged or dictionary attacks mounted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, security questions) are used, then user registration and authentication are simple to implement, but they are vulnerable to data breaches, phishing attacks, and social engineering
Solution Approach 1:
The patent divides the authentication secret into multiple independent shares distributed across different devices. No single device holds the complete authentication credential, so compromising one device does not enable unauthorized access. The secret is segmented into n-1 authentication shares that must be combined to reconstruct the original credential.
Solution Approach 2:
The patent introduces a threshold cryptography system as an intermediary layer between the user's password and the authentication verification process. This mediator uses secret sharing schemes and cryptographic protocols to enable secure multi-party authentication without exposing the underlying password or requiring trust in any single intermediary service.
2Reliability
If multi-factor authentication is implemented to improve security, then authentication reliability increases, but user convenience and ease of operation decrease
Solution Approach 1:
The patent merges multiple authentication factors into a single unified threshold authentication process. Instead of requiring users to manually present multiple separate credentials (password + OTP + biometric), the system combines these factors into shared secrets that are automatically presented by participating devices, reducing the operational burden on users while maintaining strong security.
Solution Approach 2:
The system enables devices to automatically perform authentication operations without requiring user intervention for each factor. The authentication shares are stored and managed by the devices themselves, which can independently participate in the threshold authentication process, eliminating the need for users to manually configure or present multiple authentication factors.
3Device complexity
If centralized authentication servers are used to manage credentials, then authentication coordination is simplified, but the system becomes a single point of failure and target for attacks
Solution Approach 1:
The patent segments the authentication credential management across multiple independent devices rather than centralizing it in a single server. Each device holds a portion of the authentication secret, and the system uses distributed threshold cryptography to coordinate authentication without requiring a central credential repository, eliminating the single point of failure.
Solution Approach 2:
The patent transitions from a centralized two-dimensional architecture (single server managing all credentials) to a distributed multi-dimensional architecture where authentication capability is spread across multiple devices in a network. This dimensional change from centralized to distributed architecture provides resilience while maintaining coordination through cryptographic protocols.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
Embodiments disclosed herein are directed to methods and systems of password-based threshold authentication, which distributes the role of an authentication server among multiple servers. Any t servers can collectively verify passwords and generate authentication tokens, while no t − 1 servers can forge a valid token or mount offline dictionary attacks.