Challenge-Response Single-Use Password Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security appliances face challenges with single factor authentication methods, such as username/password pairs, which are not sufficiently secure, and two-factor authentication methods that require separate smart cards for each appliance, leading to management complexities and restrictions on access protocols.
Innovation Solution
A system and method using a challenge/response protocol to generate a single-use password for administrator authentication, where a smart card and management console collaborate to verify identity through a public key and salt value, enabling two-factor authentication without the need for multiple smart cards, allowing access via conventional SSH clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two-factor authentication using separate smart cards for each security appliance is implemented, then security is improved, but device complexity and management difficulty increase
Solution Approach 1:
The patent implements a universal smart card system where a single smart card can be used to authenticate across multiple security appliances. The smart card contains cryptographic credentials that are recognized by any appliance in the system, eliminating the need for appliance-specific cards. This multi-functional approach maintains high security through cryptographic verification while dramatically simplifying card management, as administrators no longer need to distribute and track multiple separate cards.
2Reliability
If two-factor authentication with smart cards is required, then authentication security is improved, but ease of operation deteriorates due to protocol restrictions
Solution Approach 1:
The patent introduces a challenge-response authentication mechanism as an intermediary layer between the smart card and the security appliance. Instead of requiring direct smart card integration with specific protocols, the system uses a standardized challenge-response exchange that can be implemented across different protocols including SSH, Telnet, and web interfaces. The smart card proves possession of cryptographic credentials by responding to challenges, enabling secure authentication without protocol-specific modifications.
3Ease of operation
If conventional username/password authentication is used, then ease of operation is maintained, but security is insufficient
Solution Approach 1:
The patent merges conventional username/password authentication with smart card-based two-factor authentication into a unified system. The username component provides user identification and interface compatibility, while the smart card provides cryptographic proof of identity. This combination maintains the familiar username entry interface that users are already accustomed to, while adding the security layer of smart card verification. The system processes both factors together in a single authentication flow, achieving both convenience and security.
Data Source
AI summary
A system and method which generates a single use password based on a challenge/response protocol. A box manager module executing within a security appliance identifies a public key (P) and salt value (S) associated with an administrator's smart card and generates a random nonce (N). The box manager transmits a challenge comprising the following elements: <SHA1(N), BM_ID, P[N, BM_ID], S>. Upon receiving the challenge, the administration card decrypts P[N, BM_ID] using the private key contained within the card and computes SHA1(N). The administration card then compares its computed values with the received values from the box manager. If the values match, then to the administration card returns a response comprising the following elements: HMAC_N[user, SHA1 (password, S)], where HMAC_N represents the SHA1 keyed hash message authentication check of the response elements using the nonce N as the key.