Multi-factor Authentication Apparatus Pre-loading Passcodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing two-factor authentication methods using mobile phones face reliability issues due to text message delivery delays, signal dead spots, and network connectivity problems, leading to increased help desk calls, especially in large-scale deployments.
Innovation Solution
A multi-factor authentication apparatus that pre-loads a first factor, such as a passcode, onto a user's notification device before the authentication process, allowing for the use of stored passcodes even if the user cannot receive new messages, and dynamically updates passcodes upon successful or failed authentication attempts to ensure continuous access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passcodes are sent as text messages to mobile phones during authentication, then users can receive passcodes for authentication, but text message delivery delays and signal dead spots cause authentication failures
Solution Approach 1:
The system pre-loads passcodes onto the user's notification device before the authentication process begins. When a user initiates authentication, the pre-loaded passcode is immediately available for use without requiring real-time message delivery. This preliminary action eliminates delays caused by network congestion and signal dead spots.
Solution Approach 2:
The authentication system introduces an intermediary mechanism where passcodes are stored locally on the user's device rather than being delivered in real-time through the mobile network. This intermediary storage layer decouples the authentication process from network reliability, allowing users to access passcodes even when network connectivity is poor or unavailable.
2Ease of operation
If passcodes are pre-loaded onto notification devices, then users can authenticate without relying on immediate text message delivery, but security risks increase if passcodes are compromised
Solution Approach 1:
The system dynamically changes the validity period and usage state of passcodes. Each passcode is marked as used immediately upon successful authentication or after a short timeout period if not used. This parameter change ensures that even if a passcode is compromised, its window for exploitation is extremely limited.
Solution Approach 2:
The authentication system implements feedback mechanisms where the server tracks which passcodes have been used and communicates this information back to the notification device. The system also monitors authentication attempts and can revoke or invalidate passcodes if suspicious activity is detected, providing continuous security feedback.
3Reliability
If multiple passcodes are stored for users, then authentication can proceed even if some passcodes are missed or expired, but system complexity and storage requirements increase
Solution Approach 1:
The system segments the passcode storage and management into distinct components: the notification device stores only the current and next passcodes locally, while the authentication server maintains the master record of all issued passcodes and their validity states. This segmentation reduces the storage burden on user devices while maintaining high availability.
Solution Approach 2:
The system automatically discards used or expired passcodes from active storage and recovers storage space for new passcodes. When a passcode is successfully used or expires, it is removed from the notification device's active list, and new passcodes are generated and loaded in its place, maintaining a manageable number of valid passcodes at any time.
Data Source
Figure 1A
Figure 1B~2
Figure 3
AI summary
Multi-factor authentication apparatus pre-loads a first factor, for example a passcode, to user equipment such as a mobile telephone. The user subsequently initiates access to a protected product or service, triggering the apparatus to run a multi-factor authentication process, via an access device such as a computer connected to the Internet. The user enters the pre-loaded first factor, together with another factor such as a UserID and PIN. The pre-loading avoids vulnerability to communications problems at the time the user initiates access. Pre-loading is done every time an access session terminates for the user, either successful or failed and a user profile data store is used to manage passcodes in a manner that allows incorrectly entered first factors to be retried when delivery to user equipment is not possible.