Disconnected Authentication via Downloaded Verification Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems relying on authentication tokens are ineffective when the authentication server is unavailable or if the computer is compromised, as they do not provide secure verification without interaction with the remote server, leading to potential impersonation risks.
Innovation Solution
A system that downloads verification records to a computer, such as a laptop, allowing it to authenticate users without server interaction by using hashed one-time passcodes generated by an authentication token, with salt and pepper values to secure the process and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the computer stores verification information locally to enable disconnected authentication, then authentication capability without server interaction is improved, but security vulnerability increases if the computer is lost or stolen
Solution Approach 1:
The authentication system is segmented into two parts: the authentication token stored on the computer and the verification information stored on the server. The verification information is further segmented into time-based records that are downloaded periodically. This segmentation allows the computer to authenticate without constant server interaction while limiting the impact of compromise to only the local token, not the verification credentials.
Solution Approach 2:
The system performs preliminary action by downloading verification records from the server before disconnection occurs. These pre-downloaded records contain hashed authentication strings for future time periods, enabling the computer to authenticate users without real-time server interaction. The records are prepared in advance and stored locally for use during disconnected periods.
2Ease of operation
If the system uses standard passwords for authentication, then ease of operation is improved, but security level deteriorates
Solution Approach 1:
The system extracts the authentication burden from the user and places it on the authentication token. Instead of requiring users to remember and type passwords, the token automatically generates authentication strings based on time-based algorithms. The user simply needs to possess the token and provide it to the computer, which then uses the pre-downloaded verification records to authenticate without requiring password entry.
3Adaptability or versatility
If the computer stores authentication verification information, then disconnected authentication capability is improved, but the risk of impersonation attacks increases if verification information is obtained by intruders
Solution Approach 1:
The system changes the parameter of information storage by using hashed authentication strings instead of storing plain text credentials. The verification records contain hashes of authentication strings combined with time-based parameters. This parameter change makes the stored information useless for impersonation attacks, as the hashes cannot be reversed to obtain the original authentication strings, even if an intruder gains access to the verification information.
Data Source
AI summary
In a system for disconnected authentication, verification records corresponding to given authentication token outputs over a predetermined period of time, sequence of events, and/or set of challenges are downloaded to a verifier. The records include encrypted or hashed information for the given authentication token outputs. In one embodiment using time intervals, for each time interval, token output data, a salt value, and a pepper value, are hashed and compared with the verification record for the time interval. After a successful comparison, a user can access the computer. A PIN value can also be provided as an input the hash function. A portion of the hash function output can be used as a key to decrypt an encrypted (Windows) password, or other sensitive information.