2CHK Authentication Security via Query Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods, such as passwords and one-time passwords, are vulnerable to attacks and cumbersome, while single sign-on techniques can lead to compromised accounts being accessed across multiple services, and transaction authentication is crucial but often inconvenient and costly, especially with the rise of mobile transactions.
Innovation Solution
The 2CHK system and protocol provide secure login and transaction authentication using a separate secure client application that establishes an independent communication channel with a backend authentication server, allowing for one-time passwords to be generated without a per-user shared secret, and can be implemented on desktop and mobile devices, including adjunct hardware, to enhance security and flexibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, OTPs, smartcards) are used, then user authentication can be achieved, but the system is vulnerable to MITM and MITB attacks and requires per-user shared secrets which increases complexity
Solution Approach 1:
The patent extracts the shared secret from the per-user context and places it at the server level. Instead of each user having a unique shared secret with the server, there is a single shared secret between the server and the 2CHK system. This eliminates the complexity of managing numerous per-user secrets while maintaining authentication security through the server's ability to generate OTPs using the centralized shared secret.
Solution Approach 2:
The patent introduces 2CHK as an intermediary layer between the user and the server. This intermediary handles the authentication process by generating OTPs on behalf of the server using the shared secret, then presenting these OTPs to the user. This mediator architecture allows the server to authenticate users without directly managing per-user secrets, thus reducing complexity while maintaining security.
2Ease of operation
If single sign-on techniques (OpenID, Facebook Connect) are used, then login convenience is improved, but compromised master accounts can be used to break into all other accounts
Solution Approach 1:
The patent segments the authentication process into distinct components: the shared secret stored securely on the server, the OTP generation function, and the user interaction layer. This segmentation ensures that even if one component is compromised, the damage is contained. The server's shared secret remains protected, and OTPs are generated only when the server explicitly requests them, preventing propagation of compromises across multiple accounts.
Solution Approach 2:
The patent implements preliminary verification through OTP generation before allowing access. The server generates an OTP as a preliminary authentication step that must be verified before granting access to the user's account. This preliminary action creates an additional security barrier that prevents attackers from using compromised credentials to access accounts, as they cannot generate valid OTPs without the server's shared secret.
3Reliability
If out-of-band authentication (voice calls, text messages) is used for transaction confirmation, then transaction security is improved, but the process becomes too costly and cumbersome for frequent use
Solution Approach 1:
The patent implements a self-service authentication mechanism where the user's own device (2CHK) generates and provides the authentication code (OTP) in response to server requests. This eliminates the need for external out-of-band communication channels like voice calls or text messages. The user simply interacts with their 2CHK device to provide authentication, making the process convenient for frequent use while maintaining strong security through the server-validated OTP mechanism.
4Reliability
If per-user shared secrets are used in OTP systems, then authentication security is maintained, but the system complexity and cost increase significantly
Solution Approach 1:
The patent makes the shared secret universal by using a single secret that serves all authentication purposes across all users. Instead of each user having a dedicated shared secret with the server, there is one universal shared secret between the server and the 2CHK system that enables OTP generation for all users. This universal approach dramatically reduces complexity while maintaining security, as the server can generate OTPs for any user using the same shared secret and user-specific identifiers.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A security server receives a request of a user to activate a secure communications channel over the network and, in response, transmits an activation code for delivery to the user via another network. The security server receives an activation code from the user network device via the network, compares the received activation code with the transmitted activation code to validate the received activation code, and activates the secure communications channel based on the validation. The security server next receives a query including a question for the user from an enterprise represented on the network, transmits the received enterprise query to the user network device via the secure communications channel, and receives, from the user network device via the secure communications channel, a user answer to the transmitted enterprise query. The security server then transmits the received user answer to the enterprise to further authenticate the user to the enterprise.