Ticket-Based Shared Secret Authentication for Sensitive Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Systems storing sensitive user data, such as healthcare information, are vulnerable to compromise, with user passwords often being compromised, revealing sensitive individual or multiple user data, necessitating improved protection methods.
Innovation Solution
A method involving the reception of encrypted user information, calculation of a shared secret, and creation of a ticket based on this secret, which is stored for a defined period, allowing secure access to data within that time frame and preventing access without the ticket or after the period expires.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user passwords are stored to enable access to sensitive data, then ease of operation is improved, but security is worsened as compromised passwords reveal sensitive user data
Solution Approach 1:
The patent segments authentication into multiple factors: something the user has (ticket), something the user knows (password), and something the system verifies (encrypted information). This multi-factor segmentation ensures that compromising one element (password) does not grant full access to sensitive data.
Solution Approach 2:
The patent introduces a ticket as an intermediary credential that mediates between the user and sensitive data. The ticket is generated after successful authentication and serves as a temporary, limited-access credential, preventing direct password-based access to data and reducing the security risk of password compromise.
2Ease of operation
If data is made accessible to users, then ease of operation is improved, but vulnerability to compromise increases
Solution Approach 1:
The patent implements dynamic access control where authentication credentials (tickets) have temporary validity periods and can be revoked. This dynamic approach allows the system to adapt access rights in real-time, granting accessibility when needed while automatically reducing vulnerability when credentials expire or are compromised.
Solution Approach 2:
The patent performs preliminary authentication and ticket generation before data access is granted. This preliminary action ensures that only verified users with valid credentials can access data, preventing unauthorized access while maintaining ease of operation for legitimate users.
3Reliability
If authentication mechanisms are strengthened to protect data, then security is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complex cryptographic verification processes from the user device and places them on the server side. The user device only needs to store and present simple tickets, while the server handles the complex decryption and verification of encrypted information, reducing device complexity while maintaining strong security.
Solution Approach 2:
The patent uses encrypted copies of authentication credentials stored on the server rather than requiring complex cryptographic operations on user devices. The server maintains encrypted versions of user information that can be verified without exposing sensitive data, simplifying the authentication mechanism while preserving security.
Data Source
AI summary
In some embodiments, a method includes receiving encrypted information associated with a user, and calculating a first portion of a shared secret based on the encrypted information associated with the user. The method also includes defining a completed portion of the shared secret based on the first portion of the shared secret and a second portion of the shared secret and storing the completed portion of the shared secret in a memory for a pre-defined period of time. The method includes defining a ticket based on the completed portion of the shared secret, and sending the ticket to a device associated with the user such that data associated with the ticket is accessible based on the ticket within the pre-defined period of time, and not accessible without the ticket or after the pre-defined period of time.