Full-Duplex Password-Less Authentication via Visual One-Time Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems rely on passwords, which are insecure, inconvenient, and prone to being forgotten, stolen, or compromised, leading to security risks and burdens for users and organizations, especially in the face of sophisticated social engineering attacks.
Innovation Solution
A full-duplex password-less authentication system that uses one-time passwords displayed as a combination of pictures and alphanumeric characters, verified through a mobile device and an authentication server, ensuring mutual authentication between the user and the service provider without the need for traditional passwords, utilizing public key cryptography and secure connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based authentication is used, then user convenience is maintained, but security is compromised due to password theft, phishing, and social engineering attacks
Solution Approach 1:
The patent extracts the password element from the authentication system entirely, replacing it with public key cryptography. Users generate a public-private key pair, and the public key is stored on the server. During authentication, the server challenges the client to prove possession of the corresponding private key without transmitting the private key itself, thereby eliminating password-related security risks while maintaining user convenience
Solution Approach 2:
The patent replaces the mechanical/password-based authentication system with a cryptographic system using public key infrastructure. Instead of transmitting or verifying passwords through traditional channels, the system uses asymmetric cryptography where the client proves authentication by signing a challenge with its private key, and the server verifies the signature using the stored public key
2Reliability
If second factor authentication (push notification, SMS, phone call) is implemented, then security is improved, but authentication speed is reduced
Solution Approach 1:
The authentication system operates autonomously without requiring user intervention beyond the initial setup. The client automatically generates authentication proofs by signing server challenges with its private key, and the server automatically verifies these proofs using stored public keys. This eliminates the need for manual second-factor verification steps while maintaining strong security
Solution Approach 2:
The system performs preliminary authentication setup during registration, where users generate their key pairs and the server stores their public keys. This preliminary action enables subsequent authentication operations to proceed rapidly without requiring additional user interaction, as the cryptographic verification can be performed automatically and instantaneously
3Reliability
If hardware tokens are used for authentication, then security is enhanced, but scalability is reduced and costs increase
Solution Approach 1:
The patent implements a universal authentication mechanism based on public key cryptography that can be deployed across multiple platforms and devices without requiring specialized hardware tokens. The same cryptographic protocol works on mobile devices, desktop computers, and servers, providing both security enhancement and system scalability simultaneously
Solution Approach 2:
Instead of requiring physical hardware tokens for each user, the system uses digital copies of public keys stored on the server. These digital representations can be replicated and verified infinitely without additional physical resources, enabling the system to scale to large numbers of users while maintaining security equivalent to hardware-based solutions
4Reliability
If passwords are made more complex to resist attacks, then security is improved, but user convenience and memory retention are reduced
Solution Approach 1:
The patent removes passwords entirely from the authentication process, replacing them with public key cryptography. Users never need to remember, create, or transmit passwords. Instead, authentication is based on proving possession of a private key through cryptographic signatures, completely eliminating the trade-off between password complexity and user convenience
Data Source
AI summary
Upon an attempt to access a service of a third-party server, full-duplex password-less authentication provides a one-time password to the user displayed at the client device and at a mobile device associated with the user. The user verifies the access by comparing the one-time password displayed at the mobile device and the one-time password displayed at the client device. In some embodiments, the one-time password is displayed as a picture while in other embodiments, a combination of a picture the one-time password is displayed as a picture and a set of alphanumeric characters for ease in making the comparison. The user determines whether to accept or deny the authentication sequence after a simple visual comparison.