Full-Duplex Password-Less Authentication via Visual OTP Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems rely on passwords, which are insecure, inconvenient, and prone to being forgotten, stolen, or compromised, and do not provide mutual authentication between users and services, making them vulnerable to various cyber attacks.
Innovation Solution
A full-duplex password-less authentication system that uses one-time passwords displayed as images and alphanumeric characters for visual comparison on both client and mobile devices, along with public key cryptography to securely authenticate users and services without the need for traditional passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based authentication is used, then user identification can be verified, but security is compromised due to password theft, phishing, and man-in-the-middle attacks
Solution Approach 1:
The patent extracts the password from the authentication process entirely, replacing it with public key cryptography where the private key never leaves the user's device. This eliminates the vulnerability to password-based attacks while maintaining authentication functionality.
Solution Approach 2:
The patent introduces a push notification server as an intermediary that facilitates authentication without exposing sensitive credentials. The server transmits push notifications to the user's mobile device, enabling secure verification without direct exposure of private keys or passwords.
2Reliability
If second factor authentication (push notification, SMS, phone call) is added to legacy authentication, then security is improved, but the authentication process becomes slower and more complex
Solution Approach 1:
The patent performs preliminary actions by pre-generating public-private key pairs during device setup and pre-establishing push notification subscriptions. This allows authentication to proceed rapidly during actual login without requiring real-time complex verification processes.
Solution Approach 2:
The user's mobile device autonomously handles authentication by automatically receiving and processing push notifications, generating signatures, and verifying authenticity without requiring manual intervention or coordination of multiple verification steps.
3Reliability
If hardware tokens are used for authentication, then security is improved, but scalability is reduced, cost increases, and devices are easy to lose
Solution Approach 1:
The patent makes the authentication system universal by implementing software-based public key cryptography that can be deployed across any device with standard computing capabilities. This eliminates the need for specialized hardware tokens while maintaining security and enabling easy scalability.
Solution Approach 2:
The patent replaces the mechanical hardware token system with a software-based cryptographic system. Public key infrastructure and push notification mechanisms substitute for physical hardware, enabling more flexible and scalable deployment without sacrificing security.
4Reliability
If passwords are made more complex to improve security, then resistance to guessing attacks improves, but user convenience deteriorates and passwords are more likely to be forgotten
Solution Approach 1:
The patent extracts the password entirely from the authentication process, replacing it with public key cryptography. Users interact with intuitive push notifications rather than complex passwords, eliminating the trade-off between security and convenience.
Solution Approach 2:
The patent substitutes the manual password entry and memorization system with an automated push notification system. The mobile device automatically receives and processes authentication requests, eliminating the need for users to remember or type complex passwords.
Data Source
AI summary
Upon an attempt to access a service of a third-party server, full-duplex password-less authentication provides a one-time password to the user displayed at the client device and at a mobile device associated with the user. The user verifies the access by comparing the one-time password displayed at the mobile device and the one-time password displayed at the client device. The one-time password is displayed as a combination of a picture and a set of alphanumeric characters for ease in making the comparison. The user determines whether to accept or deny the authentication sequence after a simple visual comparison.