Authentication Vector Product Generation via Secondary Secret
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods in electronic communication are either insecure due to low complexity, making them vulnerable to misuse, or overly complex and cumbersome, leading to user reluctance and increased costs, with a lack of adaptability to varying security demands and susceptibility to attacks on authentication devices.
Innovation Solution
A method that creates a secondary authentication secret during primary authentication, which is used to transform authentication vector elements, enhancing security by making the secondary authentication secret unpredictable and adaptable to specific transaction demands, and includes mechanisms to detect copying and verify local authentication factors, data channel integrity, and user identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If simplified authentication methods are used, then user convenience and cost are improved, but security level deteriorates
Solution Approach 1:
The system dynamically adapts authentication complexity based on security requirements. The server can request different numbers of authentication factors (e.g., 2 out of 5) depending on the service's security level, allowing simple authentication for low-security services and complex authentication for high-security services, thus resolving the contradiction between user convenience and security level.
Solution Approach 2:
The system changes the parameter of authentication factor quantity and type based on service requirements. By adjusting the number of required authentication factors and their types (knowledge-based, possession-based, biometric), the system can optimize the balance between ease of operation and security level for different services.
2Reliability
If specialized authentication devices are used, then security level is improved, but device complexity and cost increase
Solution Approach 1:
The system uses universal authentication factors that can be implemented across different devices and platforms. The five types of authentication factors (passwords, PINs, tokens, biometrics, device identifiers) can be implemented using standard device components rather than specialized hardware, reducing device complexity while maintaining high security levels.
Solution Approach 2:
The system stores authentication factor values in encrypted form in the server's database, creating secure copies of authentication data. This allows the server to verify authentication without requiring specialized authentication devices at the server end, reducing overall system complexity while maintaining security.
3Reliability
If multiple authentication factors are used, then security level is improved, but user complicacy increases
Solution Approach 1:
The system dynamically determines the number of authentication factors required based on the service's security level. For low-security services, only 2 factors may be required, while high-security services may require up to 5 factors. This dynamic adaptation reduces user complicacy for routine low-security operations while maintaining high security when needed.
Solution Approach 2:
The system implements partial authentication by requiring only a subset of available authentication factors (e.g., 2 out of 5) based on security requirements. This partial action approach provides sufficient security for most services without requiring all possible authentication factors, thereby reducing user complicacy.
4Speed
If authentication factors are evaluated directly by the authentication device, then processing speed is improved, but security deteriorates due to bypass risks
Solution Approach 1:
The system extracts the critical security function of authentication factor evaluation from the client device and relocates it to the server. The client device only collects and transmits authentication factor values, while the server performs the secure evaluation by comparing against stored encrypted values. This extraction prevents attackers from bypassing security by compromising the client device, while the server's centralized control maintains security integrity.
5Adaptability or versatility
If different authentication means are used for different services, then security adaptability is improved, but overall system complexity increases
Solution Approach 1:
The system implements a universal authentication framework that works across all services with a consistent set of five authentication factor types. The server adapts the configuration of required factors based on each service's security level, but the underlying authentication mechanism remains uniform. This universality provides security adaptability without increasing system complexity, as the same infrastructure serves all services.
Data Source
AI summary
A method of securing authentication in electronic communication between at least one user authentication mechanism and at least one server authentication mechanism, wherein primary authentication is performed in the first step, and during the primary authentication a secondary authentication secret is created and shared between the user authentication and the server authentication mechanisms and is valid only for the given authentication transaction, and the secondary authentication secret is subsequently used as an input for a cryptographic transformation performed by the user authentication mechanism separately on each authentication vector element while creating the first authentication vector product, wherein authentication vector (AV) is an ordered set of authentication vector elements (AVE)(i)), wherein the first authentication vector product is transferred from the user authentication mechanism to the server authentication mechanism and is evaluated by the server authentication mechanism using the secondary authentication secret.