Context-Based One-Time Dynamic Password Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time dynamic password (OTP) systems face challenges in maintaining synchronization between client and server, leading to authentication failures due to timer drift or network failures, requiring administrative intervention and potentially compromising security.
Innovation Solution
The use of user context information to generate a dynamic value, combined with a Personal Identification Number (PIN), to create a one-time dynamic password, which is then verified by an authentication server with a context management server to ensure synchronization and secure authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If time-based or counter-based synchronization methods are used to generate OTPs at client and server, then both ends can independently generate OTPs, but timer drift or network failures cause out-of-synchronization leading to authentication failures
Solution Approach 1:
The patent introduces a context management server as an intermediary that stores and manages context information (device identifiers, application identifiers, user profiles). This mediator enables the authentication server to retrieve the exact context used by the client to generate the OTP, ensuring both ends use identical input parameters without requiring tight synchronization of timers or counters.
Solution Approach 2:
The system pre-stores context information (device identifiers, application identifiers, user profiles) in the context management server before OTP generation is needed. This preliminary storage of contextual data allows the authentication server to reconstruct the exact same input conditions that the client used, eliminating the need for continuous synchronization during OTP generation.
2Productivity
If precision timers are used in time-based OTP systems to generate OTPs, then OTPs can be generated independently at client and server, but timer drift over time causes synchronization failures
Solution Approach 1:
The patent replaces the mechanical timer-based synchronization system with an information-based system. Instead of relying on precise timekeeping mechanisms that drift, the system substitutes context information (device identifiers, application identifiers, user profiles) that is stored and retrieved digitally, eliminating the physical constraint of timer drift while maintaining rapid OTP generation.
3Ease of operation
If auto resynchronization is implemented in OTP systems to recover from drift, then synchronization can be restored automatically, but security is compromised
Solution Approach 1:
The patent extracts the synchronization problem from the OTP generation process itself. By separating context information storage (in the context management server) from OTP generation (at the client and authentication server), the system eliminates the need for resynchronization mechanisms entirely. Each OTP is generated independently using freshly retrieved context information, removing the security vulnerability associated with auto-resynchronization while maintaining ease of operation.
Data Source
AI summary
The invention relates to a system and method for generating and authenticating one time dynamic password based on the context information related to a user. It involves retrieving user context information and generating a dynamic value based on that. The first one time dynamic password is generated at the user device using the first dynamic value and the user PIN. The first dynamic value along with the user identifier is sent to the authentication server. The authentication server sends the user identifier to the context management server. The context management server has access the context information used to generate the first dynamic value and based on that they generate a second dynamic value. The authentication server receives this value and generates the second one time dynamic password and if it matches with the first one time dynamic password then the authentication server authenticates the first one time dynamic password.