Access Control Server One-Time Password Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional access devices, including commercial off-the-shelf devices like mobile phones, are vulnerable to hacking and compromise due to their lack of specialized security features for processing user secrets, and the act of entering secrets into these devices can lead to security issues such as key logging.

Innovation Solution

A method involving a directory server that receives authentication requests from access devices, determines the appropriate access control server, and facilitates a two-factor authentication process using one-time passwords or out-of-band authentication requests, ensuring that user secrets are never directly entered into potentially insecure access devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If commercial off-the-shelf devices like mobile phones are used as access devices, then ease of operation is improved, but security against hacking and compromise deteriorates

Engineering Contradiction:

Improveease of operationVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent introduces an access controller as an intermediary device between the user and the access device. This controller generates one-time passwords and manages authentication, acting as a mediator that protects the user's secret information while enabling the use of commercial off-the-shelf devices. The intermediary handles the security-critical functions that would otherwise need to be built into every access device.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent extracts the security-critical secret information handling from the access device itself and places it in a separate access controller. By taking out the generation and management of one-time passwords from the potentially vulnerable access device, the system maintains security while allowing the access device to be a simple commercial off-the-shelf device.

Inventive Principle:

Principle #2Taking out (Extraction)

2Adaptability or versatility

If users enter secrets into access devices, then authentication functionality is achieved, but vulnerability to key logging and secret theft increases

Engineering Contradiction:

Improveauthentication functionalityVSAvoidkey logging vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

Instead of having the user enter a secret into the access device and then verifying it, the system inverts the process: the access controller generates a one-time password and provides it to the user, who then enters this generated password into the access device for verification. This inversion ensures the user never types their actual secret into a potentially vulnerable device.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The access controller performs preliminary action by generating the one-time password before the authentication process begins. This pre-generated password is then used in the authentication, eliminating the need for the user to input their secret information into the access device in the first place.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If dedicated security features are added to access devices, then security is improved, but device complexity and manufacturing cost increase

Engineering Contradiction:

ImprovesecurityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The access controller serves multiple functions: it generates one-time passwords, manages authentication logic, and communicates with various access devices. By consolidating these security functions into a single multi-functional controller rather than embedding them in every access device, the system achieves high security without increasing the complexity of individual access devices.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20250168639A1User authentication at access control server using mobile device

Publication Date: 2025.05.22 VISA INTERNATIONAL SERVICE ASSOCIATION

AI summary

A directory server is programmed to receive, from an access device, a first authentication request message comprising a credential or a token, and transmit, to an access control server, the first authentication request message. The access control server is programmed to transmit a one-time password to a user device. The directory server is further programmed to receive, from the access device, a second authentication request message with the credential or the token, and the one-time password, and transmit, to the access control server, the second authentication request message. The access control server is further programmed to validate the one-time password and generate an authentication response message including an authentication indicator in response to validating the one-time password. The directory server is further programmed to receive, from the access control server, the authentication response message including the authentication indicator and transmit the same to the access device.