Dynamic Credential Rotation for Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic authentication methods are vulnerable to man-in-the-middle attacks and fraud in recurring or incremental transactions, where a third party can intercept and reuse authentication credentials, allowing unauthorized access and fraudulent activities.
Innovation Solution
A computer-implemented authentication method that generates a new authentication credential for each authentication attempt, linking it to a previous credential and de-authorizing the previous credential to prevent reuse, thereby enhancing security against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the same authentication credential is reused for multiple authentication attempts, then the ease of operation is improved, but the security against man-in-the-middle attacks deteriorates
Solution Approach 1:
The authentication credential is divided into a sequence of distinct credentials (first authentication credential, second authentication credential, etc.), where each credential is valid for a specific authentication attempt. This segmentation ensures that even if one credential is intercepted, subsequent credentials remain secure, resolving the contradiction between ease of repeated authentication and security against interception.
Solution Approach 2:
The authentication system dynamically generates new credentials for each authentication attempt rather than using a static credential. The authentication server dynamically creates a second authentication credential after validating the first one, making the credential valid only for its specific purpose and time window, thus maintaining both ease of operation and security.
2Reliability
If a new authentication credential is generated for each authentication attempt, then the security against credential reuse is improved, but the complexity of the authentication process deteriorates
Solution Approach 1:
The authentication server provides feedback by validating the previous credential and then generating a new credential based on that validation. This feedback mechanism automatically manages the credential lifecycle, reducing the complexity burden on the client device while maintaining high security through automated credential rotation.
Solution Approach 2:
The authentication server acts as an intermediary that handles the complex tasks of validating previous credentials and generating new credentials. This shifts the complexity from the client device to the server, allowing the client to simply provide and use credentials without managing the complexity of credential generation and validation logic.
3Reliability
If the first authentication credential is de-authorised after successful validation, then the security against fraudulent use is improved, but the loss of information increases
Solution Approach 1:
The first authentication credential is deliberately discarded (de-authorised) after it has served its purpose of validating the user's identity for the current authentication attempt. This discarding prevents fraudulent reuse of the credential, while the system recovers security by generating a fresh second authentication credential that replaces the discarded first credential, maintaining both security and information management.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The invention provides an authentication technique that involves provision of a new authentication credential for each authentication attempt. The requestor of the new authentication credential is required to provide a previous authentication credential in order to successfully receive the new authentication credential. The previous authentication credential has however been de-authorised so it cannot be used to authenticate the requestor, only to successfully obtain a new authentication credential. The requestor then authenticates using the new authentication credential. The cycle is repeated for as many repeat authentication attempts as are made by the requestor.