Device-Bound OTP Generation via Hardware ID Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems, such as RSA SecurID, are vulnerable to misuse and interception due to the lack of device-specific binding, allowing attackers to replicate one-time passcodes (OTPs) without access to the intended device, as the key is not tied to a specific hardware and can be intercepted during provisioning.
Innovation Solution
Incorporating a device-specific identifier, such as a unique hardware ID, into the OTP generation algorithm, which requires both the key and device-specific information to generate valid OTPs, making it harder for attackers to replicate the OTPs without access to the device and the algorithm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a key is used for OTP generation without device binding, then OTP generation is simple and keys can be shared across multiple devices, but the system becomes vulnerable to interception and replication attacks
Solution Approach 1:
The patent introduces a device identifier as an intermediary element that mediates between the key and the OTP generation process. The device identifier acts as a binding mechanism that links the cryptographic key to a specific device, preventing key reuse across devices while maintaining the simplicity of OTP generation. This resolves the contradiction by adding a layer of device-specific binding without complicating the core OTP generation algorithm.
Solution Approach 2:
The patent modifies the OTP generation function by adding the device identifier as an additional parameter. Instead of generating OTPs based solely on the key and time/counter values, the system now incorporates the device identifier into the generation process. This parameter change ensures that the same key produces different OTPs on different devices, enhancing security while preserving the ease of implementation.
2Reliability
If device-specific binding is implemented in OTP generation, then security against replication attacks is improved, but the complexity of the OTP generation algorithm increases
Solution Approach 1:
The patent segments the authentication system into distinct components: the device identifier extraction module, the OTP generation module, and the validation module. By separating the device binding functionality from the core OTP generation logic, the system achieves enhanced security without significantly increasing the complexity of the OTP generation algorithm itself. The device identifier is extracted and prepared separately, then passed to the existing OTP generation function.
Solution Approach 2:
The patent implements a universal device identifier that can be derived from various hardware characteristics (CPU ID, memory address, storage device identifiers). This multi-functional approach allows the same OTP generation algorithm to work across different device types and architectures, achieving device-specific binding without requiring device-specific customizations that would increase complexity.
3Reliability
If the key is tied to specific hardware device, then attackers cannot replicate OTPs without the device, but the key provisioning process becomes more vulnerable to interception
Solution Approach 1:
The patent performs preliminary binding of the device identifier to the key during the key provisioning phase, before the key is deployed to the device. The device identifier is extracted and bound to the key in advance, creating a pre-configured device-key association. This preliminary action ensures that the key is inherently tied to the specific device from the outset, preventing attackers from intercepting and reusing the key on different devices.
Solution Approach 2:
The patent implements preliminary anti-action by pre-binding the device identifier to the key, which proactively prevents the harmful effect of key interception and reuse. By establishing the device-key binding before potential attacks can occur, the system neutralizes the risk of provisioning interception. The device identifier acts as a preliminary safeguard that invalidates any intercepted keys attempted to be used on unauthorized devices.
Data Source
AI summary
A method, system, and computer product for use in generating one time passcodes (OTPs) in security environment, the security environment comprising an OTP generator and an OTP validator, the method comprising generating, at the OTP generator, an OTP according to a function, wherein the function includes as an input a device id, validating the OTP at the OTP validator, whereby the validation comprises generating, at the OTP validator, a second OTP according to the function, and determining whether the OTP is valid based on a comparison of the OTP with the second OTP generated at the OTP validator.