Dynamic Password Authentication Using Mobile TOTP Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for electronic transactions, such as static passwords and hardware tokens, are insecure and inconvenient, failing to provide adequate protection against unauthorized access, especially for users with multiple accounts, and suffer from cost and mobility issues.
Innovation Solution
A dynamic password authentication system using a mobile application that generates a unique one-time password based on a randomly generated character string and a symmetric encryption key, which is verified by a backend processor to ensure secure online transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static passwords are used for authentication, then the system is simple to implement, but security is weak and vulnerable to unauthorized access
Solution Approach 1:
The patent implements dynamic passwords that change over time using a time-based one-time password (TOTP) algorithm. Instead of static passwords, the system generates passwords that are valid for specific time intervals (e.g., 30 seconds), making them resistant to replay attacks and significantly improving authentication security while maintaining reasonable system complexity.
Solution Approach 2:
The system changes the password parameter from static to dynamic by incorporating time-based factors and random elements. The password is generated as a function of time, secret key, and random values, transforming it from a fixed string to a continuously changing credential that expires after use or time interval.
2Reliability
If hardware tokens generating random numbers are deployed, then authentication security is improved, but cost increases and users with multiple accounts must carry multiple tokens
Solution Approach 1:
The patent creates a universal authentication system where a single mobile device can serve multiple accounts across different services. The mobile application implements the TOTP algorithm locally, allowing users to generate one-time passwords for any registered account without needing separate hardware tokens for each service, thus providing multi-functionality and user convenience.
Solution Approach 2:
Instead of requiring physical hardware tokens, the patent replicates the token functionality in software form within mobile applications. The mobile device copies the essential functions of hardware tokens (random number generation, time-based password generation) using software-based cryptographic algorithms, eliminating the need for physical tokens while maintaining security.
3Ease of manufacture
If SMS-based one-time password authentication is used, then implementation is simple, but turn-around speed is slow and it is constrained by mobile signal strength
Solution Approach 1:
The patent implements a self-service authentication system where the mobile device independently generates one-time passwords using local cryptographic algorithms (TOTP). The device does not need to communicate with external servers during the password generation process, eliminating SMS dependencies and enabling instant password generation regardless of signal strength, thus improving authentication speed while keeping implementation simple.
Data Source
AI summary
Methods and systems for performing electronic transactions using dynamic password authentication involve, for example, sending, using a backend processor, a unique random or pseudorandom character string to the user's mobile device processor. Thereafter, also using the backend processor, a user identifier and a challenge string consisting at least in part of the user identifier and the random or pseudorandom character string encrypted with a unique encryption key may be received from the user's mobile device processor. Using the backend processor, a cipher input consisting at least in part of the user identifier and the random or pseudorandom character string is encrypted with the unique encryption key. The received encrypted challenge string is authenticated if the received encrypted challenge string matches the encrypted cipher input.