Device-Based Authentication via Challenge-Response Protocols
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Internet-centric authentication schemes are vulnerable to security breaches due to password reuse, interception of password tokens, and complex multi-factor authentication processes, leading to significant security vulnerabilities and costs for consumers and commercial interests.
Innovation Solution
A computer-implemented system using a single identity provider with a processor and non-transient storage media to manage authentication tokens, allowing users to access multiple Internet services with a device-based application that employs asymmetric cryptography and Open ID Connect protocols for secure and seamless authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single factor username and password schemes are used for Internet authentication, then ease of operation is improved, but security reliability deteriorates due to password interception and reuse vulnerabilities
Solution Approach 1:
The patent introduces a challenge origin as an intermediary component that generates time-limited authentication challenges. Instead of directly transmitting passwords between user and service, the challenge origin mediates the authentication process by issuing challenges that require cryptographic proof of knowledge without exposing the actual password, thus enhancing security while maintaining operational simplicity
Solution Approach 2:
The system transforms the authentication parameter from static passwords to dynamic challenge-response pairs. Each authentication attempt uses a unique challenge with a time limit, changing the parameter from a reusable secret to a one-time valid credential, thereby preventing password reuse attacks and interception vulnerabilities
2Reliability
If multi-factor authentication schemes are implemented to improve security, then reliability is improved, but device complexity and ease of operation worsen due to multiple tokens and configuration requirements
Solution Approach 1:
The challenge origin application on the mobile device serves multiple authentication functions simultaneously - it acts as a password manager, generates cryptographic keys, creates time-limited challenges, and communicates with multiple service providers. This multi-functionality consolidates what would otherwise require multiple separate hardware tokens into a single universal device
Solution Approach 2:
The patent merges the functions of multiple authentication factors (knowledge-based passwords, possession-based tokens, and time-based challenges) into a single integrated mobile application. The challenge origin combines these elements by using the mobile device's existing security infrastructure to manage all authentication factors through one unified interface, eliminating the need for separate physical tokens
3Reliability
If hardware-based tokens are used for multi-factor authentication, then security reliability is improved, but ease of manufacture and device complexity worsen due to token distribution and configuration requirements
Solution Approach 1:
The mobile device automatically performs authentication token generation and configuration without requiring manual administrator setup. The challenge origin application self-configures by detecting available services and generating appropriate challenges, eliminating the time-intensive administrator-controlled configuration process required for traditional hardware tokens
Solution Approach 2:
Instead of distributing physical hardware tokens, the system creates digital copies of authentication functionality within the mobile application. The challenge origin generates virtual authentication tokens that replicate the security functions of hardware tokens but exist as software-based cryptographic credentials that can be automatically distributed and configured
4Ease of operation
If conventional authentication schemes are used, then ease of operation is maintained, but loss of information increases due to password interception in network communications
Solution Approach 1:
The authentication challenges are time-limited and periodically renewed. Each challenge has an expiration time after which it becomes invalid, forcing periodic re-authentication with fresh challenges. This periodic action prevents long-term validity of intercepted credentials and limits the window of opportunity for attacks
Solution Approach 2:
The system performs preliminary cryptographic setup by generating key pairs and storing private keys securely in the mobile device before authentication is needed. This preliminary action ensures that when authentication occurs, the private key never leaves the device, preventing interception of password tokens during network communication while maintaining simple user operation
Data Source
AI summary
A system for authorizing respective initiation of a plurality of remote services by or for mobile device users. The system comprises a processor, and storage devices, at an authorization service (AS). A storage device stores public key portions of authentication tokens for mobile device users and remote service identifiers. Stored program code executable by the AS processor receives only public key portions of authentication tokens created on mobile devices. For actions to initiate a remote service, the program code is for receiving a remote service identifier and challenge information from a remote service server, transmitting at least a portion of the challenge information to a user's mobile device, receiving messages from the user's mobile device, validating at least one of the received messages using the stored public key portion of the authentication token for the user, and if validated, initiating the remote service.