Challenge-Response Token Using Pre-loaded Passcodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token-based user authentication systems are vulnerable to server-side intrusions and cannot operate in challenge-response mode, which limits their security and efficiency, especially in symmetric-key-based schemes and stored-passcode tokens.
Innovation Solution
Implementing cryptographic devices that store authentication information in a challenge-response mode, allowing them to output non-sequential portions of this information in response to challenges, while also incorporating features like proactivization and pseudorandom permutations to enhance security and prevent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If stored-passcode tokens are used, then computational complexity and power consumption are reduced, but the tokens cannot operate in challenge-response mode
Solution Approach 1:
The patent pre-loads the token with a large set of passcodes generated offline using a pseudorandom generator seeded with a secret key. This preliminary action allows the token to store multiple valid passcodes without requiring computational resources, enabling it to respond to challenges without performing online cryptographic operations.
Solution Approach 2:
The patent segments the authentication process by separating the computationally intensive passcode generation (performed offline on the server) from the token operation (performed online on the device). The token only stores and retrieves pre-generated passcodes, while the server manages the pseudorandom generation and challenge issuance.
2Device complexity
If symmetric-key-based schemes are used, then authentication is simplified, but the system becomes vulnerable to server-side intrusions
Solution Approach 1:
The system performs preliminary key establishment and passcode generation on the server side before deployment. The server generates a pseudorandom sequence using a secret key and pre-computes multiple passcodes that are loaded into the token. This preliminary action ensures that even if the server is compromised later, the attacker cannot generate valid passcodes without knowing the original secret key.
Solution Approach 2:
The patent segments the cryptographic functionality by keeping the secret key exclusively on the server while the token stores only the derived passcodes. This segmentation ensures that server compromise does not directly expose the key, and the token operates independently with pre-loaded authentication data.
3Ease of operation
If one-time passwords are generated using time-synchronous algorithms, then authentication is enabled, but the system requires reliable time synchronization
Solution Approach 1:
Instead of generating passcodes based on time synchronization during operation, the system performs preliminary generation of multiple passcodes offline and loads them into the token. The token simply retrieves the next passcode from its stored sequence without needing to compute or synchronize time, eliminating the time synchronization requirement entirely.
4Reliability
If challenge-response tokens performing online computation are used, then security against passcode harvesting is improved, but computational resources and power consumption increase
Solution Approach 1:
The system performs the computationally intensive pseudorandom passcode generation in advance on the server side, before the token is deployed. The token receives only the pre-generated passcodes and stores them without performing any cryptographic computations. This preliminary action transfers the computational burden from the resource-constrained token to the more powerful server.
Solution Approach 2:
The token is designed to be self-sufficient by storing all necessary authentication data locally. It does not need to communicate with the server during authentication operations or perform computations, simply retrieving and transmitting the next passcode from its stored sequence, thereby minimizing power consumption and computational requirements.
Data Source
AI summary
Methods, apparatus and articles of manufacture for implementing cryptographic devices operable in a challenge-response mode are provided herein. A method includes storing a set of authentication information in a first cryptographic device associated with a user, receiving a challenge in the first cryptographic device in connection with a user authentication request responsive to a request from the user to access a protected resource, wherein the challenge comprises an index of at least one non-sequential portion of the authentication information stored in the first cryptographic device, and outputting a non-sequential portion of the authentication information from the set of authentication information stored in the first cryptographic device in response to the challenge for use in authenticating the user.