Browser Toolbar OTP Generator with Trust List Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for authenticating users with one-time passwords (OTPs) lack protection against submitting OTPs to unauthorized websites and require significant user intervention, failing to provide safeguards against incorrect submissions.
Innovation Solution
A software-based OTP generator integrated within a web browser toolbar that utilizes trust lists to determine authorized websites, automatically selecting and displaying OTPs only when the user is on a trusted site, and optionally requiring user authorization for submission, combining OTPs with PINs or biometrics for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a static password is used for authentication, then the authentication process is simple, but the security is weak because the password remains compromised if leaked
Solution Approach 1:
The patent implements dynamic passwords that change over time through multiple mechanisms: time-based expiration, counter-based sequence progression, and event-based changes. This dynamic nature ensures that if a password is compromised, it only remains valid for a limited duration or under specific conditions, thereby maintaining security while simplifying the authentication process.
2Reliability
If discrete OTP generation devices are used, then dynamic passwords can be generated, but significant user intervention is required to submit the OTP
Solution Approach 1:
The patent merges the OTP generation functionality directly into the web browser environment by integrating with the address bar and utilizing browser-based trust lists. This integration eliminates the need for separate discrete devices and reduces user intervention by automatically displaying and managing OTPs within the browsing context, allowing seamless authentication without requiring users to manually transfer codes between devices.
Solution Approach 2:
The system performs self-service by automatically managing the OTP generation and display processes. The browser-based trust list mechanism automatically identifies authorized websites and manages the OTP delivery process without requiring active user participation in the technical operations, though users may need to authorize the integration initially.
3Reliability
If discrete OTP devices are used, then dynamic passwords can be generated, but no safeguards exist against submitting the OTP to unauthorized recipients
Solution Approach 1:
The patent introduces a browser-based trust list as an intermediary mechanism between the OTP generation system and the authentication target. This trust list acts as a mediator that verifies whether a website is authorized to receive OTPs before allowing the submission process to proceed, thereby preventing unauthorized recipients from obtaining dynamic passwords while maintaining the security benefits of dynamic OTP generation.
4Object-affected harmful factors
If browser integration with trust lists is implemented, then unauthorized OTP submission is prevented, but device complexity increases
Solution Approach 1:
The patent achieves universality by leveraging the existing browser infrastructure and address bar functionality to implement the trust list mechanism. Rather than creating a completely new system, the solution builds upon universal browser components that users already interact with daily, thereby preventing unauthorized OTP submission while minimizing the increase in perceived complexity through familiar user interfaces.
Data Source
AI summary
A method of submitting information as part of an authentication operation includes generating a one time password that is intended for use in an authentication operation. The method further includes providing the one time password in a display field, wherein the display field is adapted to work in conjunction with a browser to submit the one time password in response to a request for the one time password. A method of controlling submission of identity information within an authentication system includes receiving a trust list from the authentication system. The trust list identifies entities that are authorized to receive the identity information. The method further includes receiving a request to submit the identity information to a candidate entity for an authentication operation, and providing the identity information to the candidate entity if the trust list indicates that the candidate entity is authorized to receive the identity information.