Device-Bound OTP Verification via Hash Function Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional one-time password (OTP) systems are inconvenient for users, prone to errors, and vulnerable to security risks due to their short length, susceptibility to guessing, and exposure to attacks like man-in-the-middle and malware intercepts, lacking source identification.
Innovation Solution
A system that generates a seed OTP, binds it to a user device using a device fingerprint, and calculates an expected response OTP, which is verified upon user authorization, enhancing security and convenience by eliminating manual entry and adding a challenge/response mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional one-time passwords are sent via text message, then users can receive authentication codes, but the OTPs are vulnerable to interception and lack source identification
Solution Approach 1:
The patent introduces an intermediary verification mechanism where the system calculates an expected response OTP by applying a function to the seed OTP and compares it with the user's input. This intermediary calculation step acts as a mediator that validates authenticity without exposing the seed OTP, thereby preventing interception attacks while maintaining reliable authentication.
Solution Approach 2:
The system performs preliminary actions by generating a seed OTP, binding it to device metadata, and pre-calculating the expected response OTP before the user receives the authentication challenge. This preliminary preparation ensures that when the user inputs the OTP, the verification can immediately compare against a pre-computed expected value, enhancing security against real-time interception attacks.
2Ease of operation
If one-time passwords are kept short for user convenience, then entry is simpler, but they become easier to guess and less secure
Solution Approach 1:
The patent transitions from a single-dimensional short OTP to a multi-dimensional authentication system where a short seed OTP is combined with device-bound metadata (device ID, timestamp, application ID) to generate a response OTP. This dimensional expansion maintains user convenience with short input while enhancing security through the additional metadata dimensions that attackers would need to replicate.
Solution Approach 2:
The authentication system combines multiple elements (seed OTP, device identifier, timestamp, application identifier) into a composite response OTP. This composite structure maintains the short length needed for user convenience while incorporating multiple security layers that make guessing significantly harder, as all components must be correctly replicated.
3Measurement precision
If manual entry of one-time passwords is required, then verification is straightforward, but users are prone to typographical errors and selection mistakes
Solution Approach 1:
The system implements self-service by automatically generating the response OTP on the user's device using the seed OTP and device metadata, then automatically comparing it with the expected value. This eliminates manual typing and selection errors entirely, as the device performs the input and verification autonomously, achieving both high precision and ease of operation.
Solution Approach 2:
The patent replaces the mechanical manual entry process with an automated digital verification system. Instead of users physically typing or selecting OTPs, the system uses automated function application and comparison algorithms to verify authentication, eliminating typographical errors and selection mistakes while maintaining verification accuracy.
4Reliability
If device-bound OTPs are implemented, then security against interception is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal function that can be applied to any seed OTP regardless of the specific authentication context. The same function (applying a cryptographic operation and comparing with expected response) handles all device-bound OTP verifications, reducing system complexity through reuse rather than requiring separate mechanisms for each device or context.
Data Source
AI summary
A system may perform operations including transmitting a service request to a service provider, wherein the service request includes a device identifier of the computer-based system or a device fingerprint of the computer-based system; receiving a seed one-time password (OTP) to the computer-based system from the service provider, wherein the seed OTP comprises a random number that is valid for a predetermined time period and is discarded after first use; calculating a one-time password (OTP) by applying a hash function to the seed OTP, wherein the hash function is based on the device identifier of the computer-based system or the device fingerprint of the computer-based system; transmitting a response OTP to the service provider for validation by the service provider, wherein the response OTP is different from the seed OTP; and receiving a validation result from the service provider.