Windows Password Storage UNICODE Salting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication password mechanisms in Windows-based systems are vulnerable to dictionary attacks, especially when passwords are composed of ASCII codes, as they can be easily identified and cracked, lacking sufficient protection and user convenience.
Innovation Solution
The method involves converting ASCII authentication passwords to UNICODE data, salting them with a random number unique to each user, and then hashing them for storage, thereby increasing the number of bytes and making dictionary attacks more difficult, while allowing users to maintain familiar password formats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ASCII authentication passwords are stored directly in the user account database, then the system is simple and easy to implement, but the passwords are vulnerable to dictionary attacks and lack sufficient protection
Solution Approach 1:
The patent applies preliminary action by converting ASCII passwords to UNICODE format and adding random salt values before hashing occurs. This preprocessing of the password data before storage strengthens protection against dictionary attacks without requiring changes to the core authentication flow or hash function implementation.
Solution Approach 2:
The patent changes the parameter representation of passwords by converting from ASCII encoding to UNICODE encoding, which increases the byte length of each password from 1 byte per character to 2 bytes per character. This parameter change increases the complexity of dictionary attacks while maintaining compatibility with the existing authentication system.
2Reliability
If password data is converted to UNICODE and salted with random numbers, then protection against dictionary attacks is strengthened, but the processing complexity increases
Solution Approach 1:
The conversion to UNICODE and addition of salt values is performed as a preliminary action before the password is passed to the hash function. This approach strengthens security without requiring modifications to the hash function itself or the core authentication logic, isolating the complexity to a preprocessing step.
3Reliability
If the authentication mechanism is modified to enhance security, then password protection is improved, but compatibility with existing ASCII password input methods may be affected
Solution Approach 1:
The patent changes the internal representation parameter from ASCII to UNICODE while maintaining compatibility with existing ASCII input methods. Users continue to input passwords using familiar ASCII characters, but the system internally converts these to UNICODE format for storage and hashing, preserving both security and user convenience.
Data Source
AI summary
Protection of an authentication password stored in a database held by a SAM of Windows® is strengthened. A GINA, a part of the OS, receives an authentication password in ASCII codes. The authentication password is converted to first UNICODES, and the first UNICODES are salted with a random number and converted to second UNICODES. The random number used for salting is associated with a user account and a password and stored in a read/write protected non-volatile memory or a non-volatile memory which can be accessed only by a BIOS. An LSA of the OS can process UNICODES without being changed.