Condition-Based One-Time Password Generation for Secure Server Login
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional one-time passwords (OTPs) lack the ability to be restricted or linked to specific conditions, such as device or time-based access, which is desirable for secure server login scenarios.
Innovation Solution
A method where the server generates a unique one-time password using a cryptographic function of a combination of user and device IDs, with optional inclusion of a secret key, timestamp, or random number, and transmits it to the user device, allowing verification and deletion after use, thereby linking the password to specific conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional one-time passwords are used, then user devices can register with the server, but the passwords cannot be restricted or linked to specific conditions such as device or time-based access
Solution Approach 1:
The server pre-generates one-time passwords with embedded usage conditions (device ID, time validity, service scope) before the user needs them. These conditioned OTPs are stored in a database ready for immediate use when registration or authentication is required, eliminating the need for real-time condition checking during the authentication process.
Solution Approach 2:
The invention changes the parameters of the one-time password by embedding multiple attributes directly into the OTP structure, including device identifier, time validity period, and service scope. This transforms a simple random string into a structured authentication token carrying multiple control parameters that enable condition-based restrictions.
2Reliability
If one-time passwords are stored in a database for verification, then server-side comparison is enabled, but administrative burden increases due to centralized storage and management
Solution Approach 1:
The invention extracts the verification logic from centralized database storage and distributes it to individual service systems. Each service that needs to verify OTPs maintains its own local database or verification mechanism, eliminating the need for a centralized OTP storage system and reducing administrative burden on the server.
Solution Approach 2:
Each service system independently manages its own OTP verification process using the usage conditions embedded in the OTP. The system self-verifies whether the OTP is valid for the current device, time, and service scope without requiring external coordination or centralized database access, reducing overall system complexity.
3Ease of manufacture
If random character strings are used as one-time passwords, then generation is simple, but linkage to specific users or devices is not possible
Solution Approach 1:
The invention merges the random character string generation with user ID and device ID into a single OTP generation process. The OTP is created by combining these elements through cryptographic hashing or encoding, ensuring both randomness for security and unique linkage to specific user-device pairs without complicating the generation process.
Data Source
Figure 1
AI summary
A method for providing a one-time password (OTP) to a user's device (1) for logging into a server (2), wherein the server (2) generates the one-time password (OTP) using a cryptographic operation based on a unique user identifier and transmits it to the user's device (1). This method allows a service provider to attach additional conditions to the one-time password (OTP) for login, thereby increasing the service provider's flexibility in designing its services and enhancing security against manipulation.