Digital One-Time Pad Authentication Using Pre-loaded Code Blocks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication methods often rely on insecure communication channels, making them vulnerable to interception and loss of authentication tokens, which compromises security and user access.
Innovation Solution
A system that provides users with a unique block of random codes stored securely on their device, using a starting index for one-time code generation, ensuring secure communication and synchronization between the user device and the login service, even if the token is intercepted or lost.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional two-factor authentication uses SMS or less secure communication channels to send codes, then the authentication process is simple to implement, but the security is compromised and codes can be intercepted or stolen
Solution Approach 1:
The system pre-loads a large block of random authentication codes onto the user's mobile device during device setup, before any authentication occurs. This preliminary action ensures that when authentication is needed, the codes are already available in a secure local store, eliminating the need to transmit codes through insecure channels during the actual authentication process.
Solution Approach 2:
The patent introduces a secure local code store on the mobile device as an intermediary between the authentication server and the user. Instead of directly transmitting codes through insecure communication channels, the system uses this local store to retrieve and verify codes, thereby mediating the authentication process and eliminating the vulnerability of transmitting codes over less secure channels.
2Ease of manufacture
If the system transmits second authentication factors through less than secure communication channels, then the implementation is simpler, but the authentication codes become vulnerable to phishing and interception
Solution Approach 1:
The system performs the code generation and storage action in advance during device setup, creating a secure local repository of authentication codes. This preliminary action eliminates the need for complex secure transmission protocols during actual authentication, maintaining implementation simplicity while dramatically improving transmission security by using local storage instead of channel-based transmission.
3Ease of operation
If users carry physical fobs with authentication numbers, then the authentication process is straightforward, but the fobs are easily lost and prevent authorized users from logging on
Solution Approach 1:
Instead of using a single physical fob that can be lost, the system creates multiple digital copies of authentication codes stored securely in the mobile device's local storage. These digital copies replicate the functionality of physical fobs but with the added benefit of redundancy - if one code is compromised or the device is lost, other codes remain available, ensuring continuous access.
Solution Approach 2:
The system implements a mechanism where used authentication codes are automatically discarded from the active set and replaced with fresh codes from the pre-loaded block. This ensures that even if a code is intercepted or leaked, it cannot be reused by attackers, and the authorized user can continue using the system without interruption through code rotation.
4Ease of operation
If phone apps are used to transmit second authentication factors, then the user interface is user-friendly, but the apps are not secured as they must contact security services over less than secure communication channels
Solution Approach 1:
The authentication codes are pre-generated and stored locally on the mobile device during setup, before any user interaction. This eliminates the need for the app to contact security services during authentication, thereby maintaining the user-friendly interface while removing the security vulnerability associated with network communications during the authentication process.
Data Source
AI summary
An approach is provided that receives a login request from a selected user. The approach first authenticates the selected user using a unique user identifier and a password associated with the selected user. In response to a successful first authentication, the approach performs a second authentication of the selected user using a second factor authentication code that was included in the login request. The second authentication includes retrieval of an expected second factor authentication code using an index into a block of codes with the index and the block of codes both being associated with the selected user. The login request is allowed and the index is changed in response to the second factor authentication code matching the expected second factor authentication code. The login request is denied in response to the second factor authentication code failing to match the expected second factor authentication code.