Credential Seed Provisioning System for OTP Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing systems for storing and looking up credential seeds for One Time Password (OTP) authentication face inefficiencies due to large memory requirements and latency issues, especially when dealing with a large number of pre-active seeds that are not relevant to real-time authentication, which slows down the lookup process and can exceed capacity limits.
Innovation Solution
Implementing a dual data store system where credential seeds are initially stored in a pre-active data store for inactive devices and moved to an active data store upon authentication or activation, allowing for efficient real-time lookup of active seeds, thereby reducing memory usage and improving lookup speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all credential seeds (including pre-active) are stored in a single lookup table, then complete authentication capability is maintained, but memory requirements and lookup latency increase significantly
Solution Approach 1:
The patent divides the credential seed storage into two separate data stores: an active credential seed data store for seeds currently in use, and a pre-active credential seed data store for seeds that have been provisioned but not yet activated. This segmentation allows the system to maintain complete authentication capability while significantly reducing lookup latency by only searching the active data store during OTP verification.
Solution Approach 2:
The patent extracts pre-active credential seeds from the main active credential seed data store and places them in a separate pre-active data store. This extraction removes dormant seeds that would otherwise occupy memory space and potentially interfere with real-time lookup operations, thereby reducing memory requirements and improving authentication performance.
2Ease of operation
If pre-active credential seeds are stored in the active data store, then activation is simplified, but memory usage and lookup complexity increase
Solution Approach 1:
The patent implements preliminary action by storing pre-active credential seeds in a dedicated pre-active data store before they are activated. This allows the system to prepare authentication seeds in advance without burdening the active data store, maintaining memory efficiency while enabling quick activation by simply moving seeds from the pre-active to active data store when needed.
3Stability of the object's composition
If a relational database is used to store all credential seeds, then data integrity is maintained, but capacity limitations and performance issues arise
Solution Approach 1:
The patent segments the credential seed storage system into two distinct data stores with different optimization goals: the active credential seed data store is optimized for fast lookup and high authentication throughput, while the pre-active credential seed data store is optimized for efficient storage of dormant seeds. This segmentation resolves the conflict between data integrity and authentication productivity.
Solution Approach 2:
The patent implements a copying mechanism where credential seeds are copied from the pre-active data store to the active data store upon activation. This copying approach maintains data integrity through controlled replication while enabling the active data store to remain small and highly performant for real-time authentication operations.
Data Source
AI summary
A system for efficiently storing and activating credential seeds that are embedded in authentication devices. Device manufacturers provide copies of credential seeds embedded in the devices to an authentication service. The authentication service stores the credential seeds for authentication devices in a pre-active credential seed data store. When a credential seed is needed to perform a real-time or near real-time authentication of a One Time Password, the credential is fetched from the pre-active credential seed data store, used to authenticate the OTP and injected into the active credential seed data store, which can be a database. Thereafter, the credential seed is fetched from the active credential seed data store for real-time and near real-time authentication of OTPs. The credential seeds can be stored in the data stores with additional information, such as user profile data, permissions and authorizations, OTP authentication algorithm information, metadata, OTP moving factor data, time-to-live, and other attributes.