Credential Provider Authentication for Automated Analyzers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for biomedical devices, such as the combination of username and password, are insecure due to their vulnerability to misuse when multiple users share the same static combination, especially in remote access scenarios.
Innovation Solution
A two-factor authentication system that uses a credential provider to generate a random number, encrypt it with a public key, and send it to a server for verification, while also requiring a mobile phone as a possession factor for additional security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a static username and password combination is used for authentication, then ease of operation is improved, but security deteriorates because multiple users can misuse the same credentials
Solution Approach 1:
The patent transforms the static username-password authentication system into a dynamic one by introducing time-varying authentication codes that change with each login attempt and are tied to specific devices. The authentication code is no longer static but dynamically generated based on device identifiers and timestamps, preventing reuse across different devices and time periods.
Solution Approach 2:
The patent segments the authentication process into multiple independent components: a static username, a device-specific identifier, a time-varying authentication code, and a cryptographic hash function. This segmentation allows each component to serve a specific security function, where the combination of all components is required for successful authentication, thereby preventing misuse while maintaining ease of operation.
2Ease of operation
If remote access is enabled for system login, then ease of operation is improved, but security deteriorates due to additional data transfer vulnerabilities
Solution Approach 1:
The patent introduces cryptographic hash functions and device identifiers as intermediaries between the user and the authentication system. Instead of directly transmitting sensitive authentication data over the network, the system uses these intermediaries to transform and protect the data, making it computationally infeasible for attackers to retrieve original credentials even if data is intercepted during remote access.
Solution Approach 2:
The patent replaces the mechanical transmission of plain-text credentials with a cryptographic system that uses hash functions and encrypted device identifiers. This substitution transforms the authentication mechanism from a vulnerable data transmission process into a secure cryptographic verification process that resists network-based attacks.
3Ease of operation
If field service engineers share authentication credentials, then ease of operation is improved, but security deteriorates because unauthorized persons can gain access
Solution Approach 1:
The patent applies local quality by making authentication credentials device-specific rather than universally shared. Each device receives a unique authentication code tied to its identifier, so that credentials are locally valid only for their designated device. This prevents field service engineers from misusing credentials across different devices while allowing them to efficiently access multiple devices.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
The system provides maximum security by adding an extra layer of authentication, reducing the risk of unauthorized access, and ensuring that even if a random number or password is compromised, it is device-specific and cannot be used for other instruments.
Implementation Method 1
a public key of an authentication system for encrypting data prior to transmitting, wherein the credential provider is configured (i) to create encrypted data by encrypting the user ID, password and random number with the public key
Implementation Method 2
the server comprises a private key of the authentication system for decrypting transmitted encrypted data with the public key
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a work authorization system comprising a credential provider which is installed on a data processing unit of an automated analyzer instrument comprising a device for entering data, a server comprising an interface for receiving data from the credential provider and information for authentication of a user, a database containing all relevant data necessary for authentication of the user and a device for sending messages.