Dual-Device Location Hashing for Loss-Tolerant Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication (MFA) mechanisms relying on one-time passwords (OTPs) require multiple round-trip communications between the user and the authenticating server, which can be time-consuming and compromise security if the registered device is lost or stolen, reducing user productivity and access security.
Innovation Solution
A method that authenticates users based on a dynamically computed hash value of location coordinates from two co-located registered devices, eliminating the need for a second round-trip communication and ensuring access security even if one device is not in the user's possession, using GPS-enabled devices and short-range communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication uses OTP requiring multiple round-trip communications, then authentication security is improved, but communication time and user productivity deteriorate
Solution Approach 1:
The system pre-establishes trusted relationships between multiple user devices and the authentication server during device registration. Location coordinates and device identifiers are预先 stored on the server, enabling rapid authentication without requiring multiple back-and-forth communications during the actual login process
Solution Approach 2:
The invention creates a digital copy of the user's location information and device identifiers that can be verified by the authentication server without requiring the physical presence of the original device. The server stores copies of location coordinates from multiple registered devices, allowing authentication to proceed by comparing these stored copies with newly provided location data
2Ease of operation
If MFA relies on a single registered device, then authentication simplicity is improved, but security deteriorates when the device is lost or stolen
Solution Approach 1:
The system assigns different roles and characteristics to different registered devices. Each device has its own unique identifier and location coordinates stored on the server. When authenticating, the system checks the location and device identifier against the stored information for that specific device, providing device-specific security validation
Solution Approach 2:
The system预先 registers multiple devices and stores their location information on the server, creating a backup authentication mechanism. If one device is lost or stolen, the user can still authenticate using another registered device, as the server has already stored the location coordinates and device identifiers for multiple devices in advance
3Measurement precision
If authentication requires multiple round-trip communications, then verification thoroughness is improved, but user productivity deteriorates
Solution Approach 1:
The invention extracts the essential authentication elements (device identifier, location coordinates) from the complex multi-round communication process. These elements are stored on the server during device registration and can be quickly verified in a single communication round, eliminating the need for multiple back-and-forth exchanges while maintaining verification thoroughness
Data Source
AI summary
According to one embodiment, a method, computer system, and computer program product for user authentication. The embodiment may include receiving, at an authentication server, respective multiple location coordinates from first and second registered devices. Storing, on the authentication server, respective moving windows comprising registered, device specific, last n location coordinates from the first and the second registered devices. Receiving a request to access the authentication server via the first registered device. The request comprises log-in credentials of a user and a first hash value calculated at the first registered device. Computing, at the authentication server, a second hash value using a set of the last n location coordinates from each of the respective moving windows. Comparing the first hash value and the second hash value. In response to the first and the second hash values being equal, and the log-in credentials being verified, granting access to the authentication server.