Challenge-Response Password Authentication for Mobile Sync

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing challenge response systems for mobile devices cannot securely transfer and authenticate passwords, especially when only the hash of the password is stored on the device, limiting operations that require the actual password, such as decrypting encrypted information during synchronization with a desktop system.

Innovation Solution

A method where the requesting device encrypts the user password using a requesting encryption key generated by hashing a challenge combined with the user password hash, and the authenticating device decrypts this using an authenticating encryption key from the stored password hash, allowing authentication and potential use of the password for operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If only the hash of the device password is stored on the mobile device, then security is improved, but the ability to perform operations requiring the actual password (such as decryption) is lost

Engineering Contradiction:

ImprovesecurityVSAvoidpassword usage capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system segments the password authentication process into two distinct components: the password hash (stored on the device for authentication) and the password itself (transferred securely during challenge-response). This allows the device to maintain security through hash storage while temporarily obtaining the actual password for operations that require it, such as decryption during synchronization.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The challenge-response mechanism acts as an intermediary process that enables secure password transfer without storing it permanently. The requesting device generates a challenge, the mobile device responds using the password hash, and through this intermediary exchange, the actual password is temporarily made available for operations while maintaining the security benefit of not storing the plain text password.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If the device password is not stored on the device, then security against unauthorized access is improved, but operations requiring the password cannot be performed

Engineering Contradiction:

Improveunauthorized access protectionVSAvoidpassword-based operations

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The system performs preliminary authentication using the password hash before any password-based operations are attempted. The challenge-response mechanism preliminarily verifies authorization, and only after successful authentication is the actual password transferred and made available for operations such as decryption, ensuring that unauthorized access is prevented while enabling legitimate operations.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The mobile device itself performs the password transfer operation through the challenge-response mechanism. When a synchronization operation is initiated, the device autonomously engages in the challenge-response exchange with the requesting device, securely transfers the password for the duration needed, performs the required operation (such as decryption), and then discards the password, eliminating the need for external password management.

Inventive Principle:

Principle #25Self-service

3Measurement precision

If the password hash is transmitted in response to a challenge, then authentication is enabled, but the actual password cannot be used for operations like decryption

Engineering Contradiction:

Improveauthentication accuracyVSAvoidpassword functionality

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system dynamically transitions from a static hash-based authentication model to a dynamic password transfer model. The challenge-response mechanism initiates a temporary state where the actual password is transferred and made available for operations. This dynamic approach allows the system to adapt between authentication mode (using hash) and operation mode (using actual password), enabling both precise authentication and versatile password functionality as needed.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS7603556B2Challenge response-based device authentication system and method

Publication Date: 2009.10.13 MALIKIE INNOVATIONS LTD

AI summary

A challenge response scheme authenticates a requesting device by an authenticating device. The authenticating device generates and issues a challenge to the requesting device. The requesting device combines the challenge with a hash of a password provided by a user, and the combination is further hashed in order to generate a requesting encryption key used to encrypt the user supplied password. The encrypted user supplied password is sent to the authenticating device as a response to the issued challenge. The authenticating device generates an authenticating encryption key by generating the hash of a combination of the challenge and a stored hash of an authenticating device password. The authenticating encryption key is used to decrypt the response in order to retrieve the user-supplied password. If the user-supplied password hash matches the stored authenticating device password hash, the requesting device is authenticated and the authenticating device is in possession of the password.