Dynamic Authentication Identifiers to Prevent Replay and MFA Fatigue
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods relying on static usernames and passwords are vulnerable to attacks such as credential theft, social engineering, replay attacks, and MFA fatigue, and do not effectively prevent collisions due to human error.
Innovation Solution
Implement systems and methods using unique, dynamic identifiers generated just-in-time by an authentication server, which can be entered by users or machines to authenticate securely, reducing the risk of attacks and eliminating collisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static usernames and passwords are used for authentication, then the system is simple to implement and operate, but it becomes vulnerable to credential theft, social engineering, replay attacks, and MFA fatigue
Solution Approach 1:
The patent implements dynamic authentication by replacing static credentials with time-limited, dynamically generated authentication codes. The authentication server generates unique codes that expire after a short period, preventing replay attacks and credential theft while maintaining user-friendly operation through automated code delivery via SMS or email.
Solution Approach 2:
The patent introduces an authentication server as an intermediary between the user and the system. This server generates and manages dynamic authentication codes, acting as a trusted mediator that eliminates the need for users to manage complex passwords while providing robust security against various attack vectors including phishing and MFA fatigue.
2Reliability
If multiple authentication factors (MFA) are implemented, then authentication security is improved, but the system becomes vulnerable to MFA prompt spamming and MFA fatigue attacks
Solution Approach 1:
The patent implements preliminary action by pre-configuring the authentication server to generate and deliver authentication codes through controlled channels (SMS or email) before authentication is needed. This eliminates the need for real-time MFA prompts that can be spammed, as the system proactively manages code delivery and expiration, preventing MFA fatigue attacks while maintaining strong security.
3Reliability
If dynamic identifiers are generated just-in-time by the authentication server, then resistance to credential attacks and replay attacks is improved, but the system complexity increases
Solution Approach 1:
The patent implements self-service by enabling the authentication server to automatically generate, deliver, and manage dynamic authentication codes without requiring manual intervention. The system self-manages code expiration, renewal, and validation, reducing operational complexity while providing robust protection against credential and replay attacks through automated just-in-time code generation.
Data Source
AI summary
Systems and methods involving various registration and authentication workflows are disclosed herein. A user may be authenticated without the use of static usernames or passwords. In some embodiments, an authentication identifier may be generated that is associated with an authentication request for a user to access a protected resource (e.g., a web app). An authentication code may be generated based on the authentication identifier. The authentication code may be sent to a computing device to be provided to the user, who may provide the authentication code to an application on their mobile device. The mobile device may send a payload containing the authentication identifier, credentials saved on the user device from a previous registration step, and a digital signature. The digital signature may be authenticated using contents of the payload before validating the authentication identifier.