Deterministic One-Time Passwords for Behavioral Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems using randomly-generated One-Time Passwords (OTPs) lack the capability to extract user-specific behavioral traits, such as typing patterns, due to their pseudo-random nature, which hinders effective user authentication and fraud detection.
Innovation Solution
Generating deterministic OTPs with specific structures, such as repeating characters or dictionary words, that allow for the extraction of user-specific behavioral traits by monitoring typing patterns, enabling more reliable user authentication and fraud mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If purely random OTP strings are generated, then security entropy is maximized, but the capability to extract user-specific behavioral traits is lost
Solution Approach 1:
The patent changes the parameters of OTP generation from purely random to structured patterns while maintaining security. Specific patterns include: (1) Repeating character patterns like 'AAAA1234' that enable detection of typing rhythm and pause characteristics; (2) Keyboard-adjacent character patterns like 'QWERT' that reveal finger movement and transition timing; (3) Numeric sequence patterns like '13579' that expose typing speed and accuracy. These parameter changes allow behavioral biometrics extraction while preserving authentication reliability through pattern verification against established user profiles.
Solution Approach 2:
The OTP string is segmented into distinct functional components: a patterned portion (e.g., 'AAAA', 'QWERT', '13579') designed to elicit measurable behavioral responses, and a random portion (e.g., '1234', '8X9Z') that maintains security entropy. This segmentation allows the system to independently optimize each component - the patterned segment for behavioral information extraction and the random segment for security - thereby resolving the contradiction between information extraction capability and security.
2Measurement precision
If deterministic patterned OTPs are used, then behavioral trait extraction is enabled, but OTP predictability increases
Solution Approach 1:
The OTP structure employs asymmetry by combining deterministic patterns in specific positions with random elements in other positions. For example, the pattern 'AAAA1234' has symmetric repeating characters at the start (enabling behavioral measurement) but asymmetric random digits at the end (maintaining unpredictability). Similarly, keyboard-adjacent patterns like 'QWERT' provide measurable finger movement data while the subsequent random characters prevent full string prediction. This asymmetric design allows behavioral measurement precision while mitigating predictability vulnerabilities.
Solution Approach 2:
The system dynamically adapts the pattern type and position based on the authentication context and user profile. Different users may receive different pattern configurations (e.g., some receive repeating character patterns, others receive keyboard-adjacent patterns), and the pattern complexity can be adjusted based on security requirements and observed behavioral consistency. This dynamic approach ensures that behavioral measurement precision is maintained while predictability remains low, as the specific pattern assigned to each user becomes part of their unique behavioral profile.
3Ease of manufacture
If random OTP strings are generated, then generation simplicity is maintained, but behavioral analysis capability is reduced
Solution Approach 1:
The OTP generation system is designed to serve multiple functions simultaneously: (1) Security authentication through verification of the correct string; (2) Behavioral biometrics extraction through analysis of typing patterns on structured sequences; (3) User profiling and fraud detection through comparison of behavioral measurements. By making the OTP system multi-functional, the patent maintains generation simplicity (using algorithmic patterns rather than complex random processes) while enabling precise behavioral measurement, thereby resolving the contradiction between ease of generation and measurement precision.
Data Source
AI summary
System, device, and method of generating and utilizing one-time passwords. A method generates a particular One-Time Password (OTP) string that is based on pre-defined OTP string construction rules. The particular OTP string is not a purely-random string; rather, the particular non-purely-random OTP string provides to a behavioral monitoring unit a capability to extract user-specific behavioral typing patterns from a way in which a user types characters of the particular OTP via a keyboard of an electronic device. The method sends the particular OTP string to the user; monitors the way that the user types the OTP string; extracts from the user interactions, that were performed while the user entered the OTP string, a user-specific behavioral typing characteristic; and based on that user-specific characteristic, determines whether that user is authenticated or non-authenticated, and optionally activates fraud mitigation operations or transaction blocking operations if the user is non-authenticated.