Dynamic Challenge-Response Authentication System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods, relying on passwords and personal identification numbers, are vulnerable to interception and spoofing, leading to insecure access to protected resources, and often result in compromised security across multiple accounts when a single breach occurs.
Innovation Solution
An authentication method that involves generating and communicating a challenge string to users, requiring them to respond with a unique response string, which is then validated to authenticate identity, while also detecting potential spoofing attempts and incorporating time-based validation to invalidate credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used, then authentication can be conducted, but the system becomes vulnerable to interception and spoofing
Solution Approach 1:
The patent implements dynamic authentication where the authentication value changes based on time, random challenges, and synchronized counters. Instead of static passwords, the system generates dynamic authentication values that are valid only for specific time windows and transactions, making interception and replay attacks ineffective
Solution Approach 2:
The system changes the parameters of authentication from fixed passwords to variable authentication values that depend on multiple parameters including time stamps, random challenge strings, and synchronized counter values. This transformation makes each authentication instance unique and resistant to spoofing
2Ease of operation
If the same password is used across multiple secured resources, then ease of access is improved, but security is compromised across all resources upon a single breach
Solution Approach 1:
The patent segments the authentication mechanism so that each secured resource has its own independent authentication instance with unique challenge strings and synchronization parameters. Even if one resource's authentication is compromised, the segmentation isolates the breach and prevents it from affecting other resources
Solution Approach 2:
The system introduces an intermediary authentication server that manages the challenge-response protocol and synchronization between the user's mobile device and multiple secured resources. This intermediary ensures that each resource authentication is independently validated, preventing cross-resource compromise
3Reliability
If challenge-response authentication is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The mobile device automatically performs challenge-response authentication without requiring manual user configuration. The device's application automatically generates responses based on received challenges using pre-configured secret keys and synchronization parameters, making the complex cryptographic operations transparent to the user
Solution Approach 2:
The system performs preliminary setup where secret keys and synchronization parameters are pre-configured in the mobile device during initial registration. This preliminary action stores the complexity in a one-time setup phase, allowing subsequent authentications to proceed with minimal user interaction and reduced perceived complexity
Data Source
AI summary
A system and method whereby the identity of a person, entity, device or the like attempting to gain access to a secured resource may be securely authenticated includes a means for receiving from a service client (such as a retail store, service station, on-line service provider or merchandiser, healthcare provider, medical insurer, information consumer or the like) a request for access to a secured resource, where the request for access was previously submitted to the service client by a requester purporting to be an authorized user of said secured resource; means for generating and communicating to the purported authorized user a challenge string adapted to provide a basis for authenticating the identity of the requester; a means for receiving from the service client a response string corresponding to the challenge string; and a means for evaluating the response string to authenticate the identity of the requester.