Dynamic Presence Identification via Rotating One-Time Password Seeds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device authentication methods using constant beacon broadcasting raise privacy and security concerns due to potential tracking and susceptibility to replay attacks, as they do not adequately protect user identity and resource access.
Innovation Solution
Implementing a one-time password seed stored on both the user's mobile device and an identification server, which generates and periodically changes presence identifiers based on this seed, ensuring that only valid identifiers are authenticated by the server before allowing access to IT infrastructure resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a mobile device constantly broadcasts a single beacon or a beacon with personally identifying information, then user identification and authentication are achieved, but user privacy is compromised due to tracking vulnerability and the system becomes susceptible to replay attacks
Solution Approach 1:
The beacon identifier is changed periodically from a static value to a dynamic value that rotates over time. The mobile device generates a new beacon identifier at each rotation interval using a one-time password algorithm, making the identifier dynamic rather than constant. This resolves the contradiction by maintaining authentication reliability while preventing tracking, as the changing identifier cannot be reused for replay attacks and does not reveal user location patterns.
Solution Approach 2:
The beacon identifier parameter is transformed from a fixed personal identifying information to a rotating one-time password generated from a seed. The identifier changes based on time and the one-time password algorithm, fundamentally altering the parameter's nature from static to dynamic. This resolves the security-privacy contradiction by ensuring each beacon transmission is unique and cannot be replayed, while preventing long-term tracking.
2Object-affected harmful factors
If a mobile device rotates presence identifiers periodically, then user privacy is protected and replay attacks are mitigated, but system complexity increases due to server validation requirements
Solution Approach 1:
An identification server acts as an intermediary between the mobile device and the resource access system. The server stores the one-time password seed, validates rotated beacon identifiers, and manages the one-time password algorithm. This intermediary approach resolves the contradiction by centralizing the complex validation logic on the server while keeping the mobile device relatively simple, as the device only needs to generate and broadcast identifiers without performing complex validation itself.
Solution Approach 2:
The one-time password seed is pre-loaded onto the mobile device during enrollment, and the identification server pre-stores the corresponding seed and configuration. This preliminary action enables the mobile device to independently generate valid rotated identifiers without needing complex validation logic, while the server is pre-prepared to validate them efficiently. This resolves the complexity contradiction by distributing preparatory work rather than requiring complex real-time processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples associated with presence identification are described. One example includes detecting a presence identifier broadcast by a mobile device. The mobile device belongs to a user. A portion of the presence identifier is generated based on a one-time password seed. The portion of the presence identifier is provided to an identification server. Identifying information associated with the user is received from the identification server. The identification server uses the portion to identify the user based on the one-time password seed. An action is performed based on the identifying information.