Client Side OTP Generation Using Masked Grid
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password (OTP) systems face vulnerabilities such as replay attacks and lack of scalability in multi-device client environments, necessitating improved authentication methods.
Innovation Solution
A client-server security architecture utilizing a masked grid and seed for mutual unlocking techniques to generate and validate one-time codes (OTCs), enabling secure connections across multiple devices by transforming data grids into masked grids, hashing seeds, and constructing cypher texts for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP systems are used, then authentication is provided, but the systems are vulnerable to replay attacks and lack scalability in multi-device environments
Solution Approach 1:
The patent implements dynamic OTP generation where the code changes based on device identity and timestamp. Each device receives a unique seed during enrollment, and the OTP is generated by hashing the seed with a counter that increments with each authentication attempt. This dynamic approach ensures that even if an OTP is captured, it cannot be replayed as it will have expired and the counter will have advanced, making replay attacks ineffective.
Solution Approach 2:
The patent segments the authentication system by assigning unique seeds to different devices during enrollment. Each device has its own segmented authentication space with unique credentials (seed + device identifier). This segmentation allows the system to scale to multiple devices while maintaining security, as each device's OTP generation is independent and cannot be compromised by another device's credentials.
2Reliability
If traditional OTP systems are used, then authentication is provided, but the systems lack scalability in multi-device client environments
Solution Approach 1:
The patent implements a universal authentication framework where the same core OTP generation algorithm serves multiple devices simultaneously. The server maintains a database of enrolled devices with their unique seeds, and the same hashing mechanism (SHA-256) and counter-based approach are used across all devices. This universal design allows the system to scale from single-device to multi-device environments without requiring different authentication mechanisms, achieving both reliability and adaptability.
3Reliability
If client-side OTP generation is implemented, then authentication security is improved, but the complexity of enrollment and validation processes increases
Solution Approach 1:
The patent implements self-service enrollment where the client device automatically generates its own unique seed during the enrollment process. The device stores this seed locally in secure storage, and the server stores only the hashed version. This self-service approach eliminates the need for manual credential distribution and reduces administrative complexity while maintaining strong security through client-side key generation and storage.
Solution Approach 2:
The patent performs preliminary actions during enrollment by pre-generating unique seeds and storing them securely in the device's secure storage before any authentication attempts. The server also pre-hashes these seeds and stores them in its database. This preliminary setup eliminates the need for complex real-time key exchange during authentication, simplifying the validation process while ensuring security credentials are already in place.
Data Source
AI summary
A client-server security architecture is disclosed that uses a masked grid, a seed, and mutual unlocking techniques to authentication a client device with a server machine using a one-time code (OTC). The client device in the client-server architecture stores a masked grid that is used to unlock an authentication code using a seed. Once mutually unlocked, the client device may generate an OTC to attempt to authenticate the client device with a server machine. The server machine validates that OTC with the OTC stored at the server to confirm they match. Each subsequent access may repeat the aforementioned steps. Moreover, in a multi-device ecosystem, a plurality of client devices may leverage a primary client device to connect with the server machine. For example, one or more subordinate client devices may connect to the primary client device to then tunnel through to the server machine in a secure manner.