Dual OTP Token System for Mutual Website and User Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online authentication systems, such as OTP tokens, are ineffective in verifying the identity of websites, particularly in preventing phishing attacks and e-commerce fraud, as they only confirm the user's identity without ensuring the authenticity of the site they are transacting with.
Innovation Solution
A dual OTP token system that uses two separate but synchronized security keys within a single device, where one key is verified by a third-party authentication server and the other is entered by the user, ensuring both 'what you have' and 'what you know' factors are validated through a two-factor-authentication process, employing asymmetric or hybrid encryption for secure verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP tokens are used to verify user identity, then user authentication is achieved, but website authenticity verification is lost
Solution Approach 1:
The authentication system is segmented into two distinct verification directions: (1) server verifies user-generated OTP, and (2) user verifies server-generated OTP. This segmentation allows each party to independently verify the other's identity, resolving the contradiction between maintaining simple user authentication while adding website verification capability.
Solution Approach 2:
A third-party authentication server acts as an intermediary that generates and manages OTP tokens for both user verification and website verification. The server mediates the mutual authentication process by providing the infrastructure for generating time-synchronized OTPs that both parties can use to verify each other's identity without direct peer-to-peer cryptographic key exchange.
2Reliability
If dual OTP token system is implemented, then both user and website verification are achieved, but system complexity increases
Solution Approach 1:
The authentication server provides universal OTP generation capability that serves multiple functions: verifying user identities, verifying website identities, and managing token distribution. This multi-functionality reduces overall system complexity by consolidating verification infrastructure in a single trusted third party rather than requiring separate systems for each verification direction.
Solution Approach 2:
The system uses cryptographic copying where the authentication server generates OTP tokens that are distributed to both the user's token device and the website's verification system. These copied tokens maintain synchronization through time-based algorithms, allowing verification without requiring complex real-time communication between user and website systems.
3Measurement precision
If time-synchronized OTP tokens are used, then user identity verification is effective, but phishing protection is insufficient
Solution Approach 1:
The system inverts the traditional authentication paradigm by enabling the user (through their token device) to verify the website's identity, rather than only having the server verify the user. This inversion creates mutual authentication where both parties prove their identity to each other, making phishing attacks ineffective since the user's token device will reject OTPs from unauthorized websites.
Data Source
AI summary
A method includes generating first and second One Time Password (OTP) token values from a shared clock, receiving a version of the second OTP token value, and comparing the second OTP token value and the version of the second OTP token value. A system includes a generator residing on an authentication server to generate first and second One Time Password (OTP) token values from a shared clock, a transmitter residing on the authentication server to transmit the first OTP token value, a receiver residing on the authentication server to receive a version of the second OTP token value, and a comparator to compare the second OTP token value and the version of the second OTP token value to authenticate a site and a user.