2CHK Authentication Security via Query Transactions

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current user authentication methods, such as passwords and one-time passwords, are vulnerable to attacks and cumbersome, while single sign-on techniques can lead to compromised accounts being accessed across multiple services, and transaction authentication is crucial but often inconvenient and costly, especially with the rise of mobile transactions.

Innovation Solution

The 2CHK system and protocol provide secure login and transaction authentication using a separate secure client application that establishes an independent communication channel with a backend authentication server, allowing for one-time passwords to be generated without a per-user shared secret, and can be implemented on desktop and mobile devices, including adjunct hardware, to enhance security and flexibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional authentication methods (passwords, OTPs, smartcards) are used, then user authentication can be achieved, but the system is vulnerable to MITM and MITB attacks and requires per-user shared secrets which increases complexity

Engineering Contradiction:
Improveauthentication securityVSAvoidper-user shared secret management
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the shared secret from the per-user context and places it at the server level. Instead of each user having a unique shared secret with the server, there is a single shared secret between the server and the 2CHK system. This eliminates the complexity of managing numerous per-user secrets while maintaining authentication security through the server's ability to generate OTPs using the centralized shared secret.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces 2CHK as an intermediary layer between the user and the server. This intermediary handles the authentication process by generating OTPs on behalf of the server using the shared secret, then presenting these OTPs to the user. This mediator architecture allows the server to authenticate users without directly managing per-user secrets, thus reducing complexity while maintaining security.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Ease of operation

If single sign-on techniques (OpenID, Facebook Connect) are used, then login convenience is improved, but compromised master accounts can be used to break into all other accounts

Engineering Contradiction:
Improvelogin convenienceVSAvoidaccount compromise propagation
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments the authentication process into distinct components: the shared secret stored securely on the server, the OTP generation function, and the user interaction layer. This segmentation ensures that even if one component is compromised, the damage is contained. The server's shared secret remains protected, and OTPs are generated only when the server explicitly requests them, preventing propagation of compromises across multiple accounts.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary verification through OTP generation before allowing access. The server generates an OTP as a preliminary authentication step that must be verified before granting access to the user's account. This preliminary action creates an additional security barrier that prevents attackers from using compromised credentials to access accounts, as they cannot generate valid OTPs without the server's shared secret.

Inventive Principle:
Principle #10Preliminary action

3Reliability

If out-of-band authentication (voice calls, text messages) is used for transaction confirmation, then transaction security is improved, but the process becomes too costly and cumbersome for frequent use

Engineering Contradiction:
Improvetransaction authentication securityVSAvoidtransaction confirmation convenience
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent implements a self-service authentication mechanism where the user's own device (2CHK) generates and provides the authentication code (OTP) in response to server requests. This eliminates the need for external out-of-band communication channels like voice calls or text messages. The user simply interacts with their 2CHK device to provide authentication, making the process convenient for frequent use while maintaining strong security through the server-validated OTP mechanism.

Inventive Principle:
Principle #25Self-service

4Reliability

If per-user shared secrets are used in OTP systems, then authentication security is maintained, but the system complexity and cost increase significantly

Engineering Contradiction:
ImproveOTP authentication securityVSAvoidshared secret storage and management
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent makes the shared secret universal by using a single secret that serves all authentication purposes across all users. Instead of each user having a dedicated shared secret with the server, there is one universal shared secret between the server and the 2CHK system that enables OTP generation for all users. This universal approach dramatically reduces complexity while maintaining security, as the server can generate OTPs for any user using the same shared secret and user-specific identifiers.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2859489B1Enhanced 2CHK authentication security with query transactions
Publication Date: 2019.08.14 EARLY WARNING SERVICES LLC
  • EP2859489B1 patent drawingFigure 1
  • EP2859489B1 patent drawingFigure 2
  • EP2859489B1 patent drawingFigure 3

AI summary

A security server receives a request of a user to activate a secure communications channel over the network and, in response, transmits an activation code for delivery to the user via another network. The security server receives an activation code from the user network device via the network, compares the received activation code with the transmitted activation code to validate the received activation code, and activates the secure communications channel based on the validation. The security server next receives a query including a question for the user from an enterprise represented on the network, transmits the received enterprise query to the user network device via the secure communications channel, and receives, from the user network device via the secure communications channel, a user answer to the transmitted enterprise query. The security server then transmits the received user answer to the enterprise to further authenticate the user to the enterprise.