Offline Generator Authentication via Time-Bound Challenge Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a secure process to generate and distribute one-time passwords (OTPs) for non-network-connected devices, such as medical equipment, to allow authorized users to reset account login credentials while preventing unauthorized access to sensitive patient data.
Innovation Solution
A system and method that involves a generator computing device generating a challenge code, displaying it, and verifying a response code received from a services computing device within a predefined time limit, using a shared secret key to authenticate the user and reset account login credentials, with out-of-band communication to ensure security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If networked systems are used for OTP-based account reset, then authentication security is improved, but security risks from data breaches and network vulnerabilities increase
Solution Approach 1:
The patent extracts the OTP generation and verification process from networked systems and implements it locally on the non-network-connected device. The device generates challenge codes locally, stores them in secure memory, and performs verification without network communication, eliminating exposure to network-based security threats while maintaining authentication security.
Solution Approach 2:
The patent introduces a secure element or trusted platform module as an intermediary component within the device that securely stores secret keys and performs cryptographic operations. This intermediary enables secure OTP generation and verification without requiring network connectivity, isolating the security-critical functions from network vulnerabilities.
2Ease of operation
If account reset functionality is provided for non-network-connected devices, then user accessibility is improved, but risk of unauthorized access increases
Solution Approach 1:
The patent implements preliminary action by pre-generating and storing multiple challenge codes in secure memory before they are needed. When account reset is initiated, the system presents these pre-prepared codes for verification. This allows quick authentication without real-time network communication, maintaining ease of operation while preventing unauthorized access through offline verification.
Solution Approach 2:
The patent uses disposable challenge codes that are generated, used once for verification, and then discarded. Each challenge code is valid for a single authentication attempt and cannot be reused, providing strong security against unauthorized access while maintaining simple user operation through one-time password entry.
3Reliability
If OTP verification with time limits is implemented, then security against replay attacks is improved, but user operation time increases
Solution Approach 1:
The patent performs preliminary action by pre-generating multiple challenge codes with embedded time validity information before authentication is needed. The system can quickly present these pre-prepared codes during verification without requiring real-time code generation, reducing user operation time while maintaining time-based security against replay attacks.
Data Source
AI summary
The present disclosure provides systems and methods for authenticating a user to reset account login credentials associated with a non-network-connected generator computing device. The generator computing device is programmed to receive a first user input requesting to initiate a reset of account login credentials, generate a challenge code, set a timer, display the generated challenge code, and receive a second user input. The second user input is a response code generated at a services computing device associated with a services provider. The generator computing device is also programmed to verify that an amount of time elapsed between generation of the challenge code and receipt of the second user input is within a predefined time limit. The generator computing device is programmed to generate an expected response code, authenticate the user by comparing the received response code to the expected response code, and reset the account login credentials.