Dynamic Token Key Segmentation for Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic tokens generate dynamic passwords based on a seed key, but once the seed key is stolen, the security of identity verification is compromised, leaving the system vulnerable to unauthorized access.
Innovation Solution
A method and system that includes a dynamic token and an authentication server, where the dynamic token generates different computing keys based on various usage codes, and the authentication server verifies dynamic passwords using these keys, reducing the risk of key theft by using different keys for different application sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single seed key is used to generate dynamic passwords, then the device complexity is reduced and ease of operation is improved, but the security reliability deteriorates because the key becomes vulnerable to theft
Solution Approach 1:
The patent segments the single seed key into multiple usage codes (first usage code, second usage code, etc.) stored in the dynamic token. Each usage code is paired with a corresponding challenge code from the authentication server to generate dynamic passwords. This segmentation allows the system to maintain multiple key pairs without increasing overall device complexity, as each segment operates independently for different application sites.
Solution Approach 2:
The patent applies local quality by assigning different usage codes to different application sites or services. Each usage code has a specific local function - the first usage code for logon authentication, the second usage code for signature authentication, and so on. This localized assignment ensures that if one usage code is compromised, only the specific application site is affected, not the entire system.
2Reliability
If different usage codes are stored for different application sites, then the security reliability is improved by reducing key theft risk, but the device complexity increases due to multiple key storage requirements
Solution Approach 1:
The patent implements universality by designing a unified key storage structure that accommodates multiple usage codes within the same dynamic token device. The token is configured to store and manage multiple usage codes (first usage code, second usage code, third usage code, etc.) along with their corresponding challenge codes, allowing a single device to serve multiple authentication purposes across different application sites without requiring separate hardware tokens for each site.
3Reliability
If multiple hash operations are performed with different usage codes, then the security reliability is enhanced through key diversity, but the processing time increases due to additional computational steps
Solution Approach 1:
The patent applies preliminary action by pre-storing multiple usage codes and their corresponding challenge codes in the dynamic token before authentication is needed. When a user needs to generate a dynamic password, the token quickly retrieves the appropriate pre-stored usage code and challenge code pair based on the application site, avoiding the need to generate or retrieve keys at the moment of authentication. This pre-preparation significantly reduces the time required for hash operations while maintaining security through key diversity.
Data Source
AI summary
A working method of a dynamic token, including the steps of grouping, by the dynamic token, the second hash data to obtain a plurality of byte groups, transforming respective byte groups into corresponding binary data by shifting and combining the bytes contained in respective byte groups; performing modulo operation on a first preset value by using sum of all the binary data obtained by transforming to a modulo result, performing modulo operation on a second preset value by using the obtained modulo result so as to obtain the first bit interception result. According to this working method, on the basis of different purpose codes, an authentication server authenticates the dynamic passwords applicable to each application scenarios, reducing the risk of keys used for generating dynamic passwords being stolen, improving the security of a token authentication system.