Automatic Two-Factor Authentication Upgrade via API Shared Secret
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network application security systems often require users to manually set up and manage separate authentication tokens for two-factor authentication, which can be cumbersome and inconsistent between web browser and API access.
Innovation Solution
A method and system that automatically upgrades one-factor authentication to two-factor authentication by using a shared secret, generated via a key-agreement protocol, to enable one-time passcode-based authentication through a REST API, allowing seamless two-factor authentication for both web browser and API clients without additional setup steps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual setup of separate authentication tokens is required for two-factor authentication, then security is enhanced, but device complexity and ease of operation deteriorate
Solution Approach 1:
The patent merges the authentication token generation and management into the existing password authentication flow. The system combines the first authentication factor (password) and second authentication factor (one-time password) into a unified authentication process, eliminating the need for separate token management while maintaining enhanced security.
Solution Approach 2:
The system enables self-service authentication by automatically generating one-time passwords on the user's device using stored shared secrets. The authentication token is generated and managed automatically by the user's own device without requiring manual setup or external token management, reducing complexity while maintaining security.
2Reliability
If separate authentication tokens are managed for web browser and API access, then authentication security is improved, but ease of operation and consistency deteriorate
Solution Approach 1:
The patent implements a universal authentication mechanism where the same shared secret and one-time password generation process serves both web browser access and API access. The authentication system is designed to be multi-functional, handling different access methods (web and API) through a common authentication flow, ensuring consistency across all access points while maintaining security.
3Ease of operation
If automatic upgrade from one-factor to two-factor authentication is implemented, then security is enhanced and ease of operation is improved, but the authentication protocol complexity increases
Solution Approach 1:
The system performs preliminary action by pre-generating and storing shared secrets during the initial password authentication. The one-time password generation capability is established in advance, allowing automatic upgrade to two-factor authentication without requiring additional setup steps. The shared secret is stored securely on the user's device, enabling future one-time password generation without further user intervention.
Data Source
AI summary
A client transmits a user identifier and a password to a server via an application programming interface (API). The client establishes an authenticated session with the server in which the client has a first set of permissions for operations associated with the API. The client receives, responsive to a verification of the user identifier and password by the server, a logon response and a shared secret. The client generates a one time passcode (OTP) based upon the shared secret. The client sends the OTP to the server via the API. Responsive to the server validating the OTP against the shared secret, the server grants a second set of permissions for operations associated with the API.