Dynamic OTP Synthesis for Mobile Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current one-time password (OTP) solutions for mobile platforms are vulnerable to unauthorized access and brute-force attacks, as the shared secret is often stored on the device, making them susceptible to viruses and spyware, and allowing hackers to replicate the OTP environment.
Innovation Solution
The shared secret for OTP generation is dynamically synthesized based on a PIN, with the PIN stored only on the server, and the client software generating OTPs without knowledge of the correct PIN, limiting failed login attempts and preventing offline brute-force attacks, using a combination of time and event-based algorithms for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the shared secret is stored on the mobile device for OTP generation, then OTP generation is simple and fast, but the device becomes vulnerable to viruses, spyware, and unauthorized access
Solution Approach 1:
The patent extracts the shared secret from the mobile device and stores it only on the server. The device receives only a seed value and a challenge, while the shared secret remains remotely stored. This extraction eliminates the security vulnerability of storing sensitive data on the device while maintaining OTP generation capability through dynamic synthesis.
Solution Approach 2:
The patent introduces a challenge value as an intermediary element. Instead of directly using the shared secret on the device, the system uses a challenge from the server that combines with the seed to dynamically create the shared secret during authentication. This intermediary mechanism enables secure remote authentication without device storage of the actual shared secret.
2Device complexity
If the shared secret is stored on the device, then OTP generation is straightforward, but hackers can replicate the OTP environment and perform brute-force attacks
Solution Approach 1:
The patent implements dynamic shared secret synthesis where the effective shared secret changes with each authentication attempt based on the challenge value. The device generates OTPs using a dynamically created shared secret (seed XORed with challenge) rather than a static stored secret, making each authentication session unique and resistant to replication and brute-force attacks.
Solution Approach 2:
The system performs preliminary synthesis of the shared secret by combining the stored seed with the received challenge before OTP generation. This preliminary action creates a unique, time-limited shared secret for each authentication attempt, preventing hackers from using previously captured OTPs or performing offline brute-force attacks.
3Ease of operation
If the client software knows the correct PIN, then OTP validation can be done locally, but the PIN becomes vulnerable to extraction and offline hacking
Solution Approach 1:
The patent extracts the PIN knowledge from the client device and keeps it exclusively on the server. The device stores only a seed value and generates OTPs using dynamic synthesis with the challenge. The server retains knowledge of the correct PIN for validation, eliminating the vulnerability of storing PINs on client devices while maintaining validation capability.
Data Source
AI summary
Methods and systems for secure user authentication utilizes OTP generation and validation techniques in which the shared secret for generating the OTP is not stored in the user's mobile device but instead is dynamically synthesized based on a PIN that activates the OTP generation and the personalized OTP data. The client software has no knowledge of what the correct PIN should be and always generates a normal looking OTP based on whatever PIN is entered, and the only way to learn whether or not the OTP is correct is to submit it during user login. By limiting the number of failed login attempts before the account is locked, brute-force attacks via the online channel will fail, and further, brute-force attacks to uncover the correct PIN for generating the correct OTP offline will also fail even if a hacker steals the user's mobile device and extracts the data inside for offline hacking, because there is nothing on the client that contains the PIN or encrypted by the PIN.