Challenge-Response Authentication Using Personal Information Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, such as username/password schemes and hardware token-based systems, face vulnerabilities like password compromise, unauthorized access, and logistical issues, necessitating a more secure and flexible authentication model.
Innovation Solution
The proposed solution involves transmitting an authentication code to a stand-alone device, which derives an authentication reply using a user's personal information code or biometric verification, generating a password for authentication, and comparing it with a model password to authenticate entities in a computer system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If username/password authentication is used, then ease of operation is improved, but security is worsened due to password compromise vulnerabilities
Solution Approach 1:
The patent introduces a challenge-response mechanism as an intermediary between the user and the authentication system. Instead of directly transmitting passwords, the system transmits a challenge that the user's device processes to generate a response. This intermediary step prevents direct password exposure while maintaining ease of operation.
Solution Approach 2:
The patent transforms the authentication parameter from a static password to a dynamic challenge-response pair. The challenge is generated by the system and the response is computed by the user's device, changing the authentication from password-based to cryptographic proof-based, thereby improving security without significantly impacting ease of operation.
2Reliability
If hardware tokens are used for authentication, then security is improved, but device complexity and logistical issues worsen
Solution Approach 1:
The patent extracts the cryptographic processing capability from dedicated hardware tokens and implements it within the user's existing device (such as a smartphone or computer). This removes the need for separate hardware tokens while maintaining the security benefits of challenge-response authentication, thereby reducing device complexity.
Solution Approach 2:
The patent enables existing multi-functional devices (smartphones, computers) to perform authentication functions that previously required dedicated hardware tokens. By utilizing the computational capabilities of universal devices, the system eliminates the need for specialized authentication hardware, reducing logistical complexity.
3Reliability
If passwords are changed regularly, then security is improved, but loss of time and user convenience worsen
Solution Approach 1:
The patent implements automatic challenge-response authentication that eliminates the need for manual password changes. The system automatically generates challenges and the user's device automatically computes responses, making the authentication process self-managing without requiring user intervention for password updates, thereby saving time while maintaining security.
Solution Approach 2:
The patent pre-configures the user's device with the necessary cryptographic capabilities and authentication credentials before they are needed. The device is prepared in advance to respond to challenges without requiring real-time password changes, eliminating the time loss associated with frequent password updates while maintaining security through continuous challenge-response authentication.
Data Source
AI summary
Various embodiments of the invention provide enhanced authentication solutions, including without limitation methods, systems and software programs for authenticating an entity and/or for facilitating such authentication. In accordance with certain embodiments, an entity (such as a user, a computer, etc.) attempts to authenticate in order to use a resource (such as a server, an application, etc.). Merely by way of example, the entity may provide a username or some other identifier to a computer responsible for authenticating the entity. In response, the authenticating computer may transmit a challenge, such as an authentication code. In particular embodiments, the challenge may be used to derive an authentication reply, which in turn may be used to derive and/or create a password (in one set of embodiments, the authentication reply itself may be the password). The derivation of the authentication reply may also require the user to provide some sort of identification, such as a personal information code (“PIC”), biometric verification, etc. The password then may be supplied to the authenticating computer, which can, in some cases, use the username and the password to authenticate the entity.