Kerberos Domain Controller Plugin for One-Time Password Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password-based authentication systems are vulnerable to brute force attacks, and one-time password (OTP) devices are not integrated with operating systems, requiring insecure third-party server modifications and additional client application changes, which complicates network access control.
Innovation Solution
A domain controller (DC) side plugin supports OTPs natively within the Kerberos protocol, leveraging static and dynamic key material to securely integrate OTPs into the operating system, minimizing core infrastructure changes and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional password-based authentication is used, then ease of operation is improved, but security against brute force attacks deteriorates
Solution Approach 1:
The patent transforms the static password parameter into a dynamic one-time password that changes with each authentication attempt. The OTP is generated based on time or counter parameters, making each password valid only for a single use or specific time window, thereby preventing brute force attacks while maintaining user-friendly authentication.
Solution Approach 2:
The authentication system transitions from static passwords to dynamic one-time passwords that are generated and expire automatically. The OTP device continuously generates new passwords based on internal state (time/counter), making the authentication credentials dynamic and resistant to replay and brute force attacks.
2Reliability
If OTP devices are integrated without OS support, then security is improved, but device complexity and ease of manufacture worsen due to required modifications
Solution Approach 1:
The patent introduces an intermediary component layer between the OTP device and the authentication protocol. This intermediary handles the OTP generation and integration logic, allowing the OTP device to work with standard authentication protocols without requiring deep modifications to the operating system or authentication infrastructure.
Solution Approach 2:
The OTP integration mechanism is designed to be universal and protocol-agnostic, allowing the same integration approach to work across different authentication protocols and operating systems. This multi-functionality reduces the need for protocol-specific modifications and simplifies deployment across diverse systems.
3Reliability
If OTP integration requires client application modifications, then security is improved, but ease of operation and productivity deteriorate
Solution Approach 1:
The patent extracts the OTP generation and management logic from individual client applications and consolidates it into a separate, reusable component or library. This extraction allows multiple applications to utilize OTP authentication without each application needing to implement its own OTP logic, significantly reducing deployment complexity and maintenance burden.
Solution Approach 2:
The OTP integration mechanism is prepared and configured in advance as a pre-built component that can be readily deployed to multiple applications. The integration logic is established beforehand, allowing applications to adopt OTP authentication through simple integration rather than extensive custom development, thereby improving productivity and reducing deployment time.
Data Source
AI summary
A domain controller (DC) side plugin supports one time passwords natively in Kerberos, Part of the key material is static and the other part is dynamic, thereby leveraging properties unique to each to securely support one time passwords in an operating system. The user is permitted to type in the one time passcode into a logon user interface. Rather than calling the SAM APIs to get the static passwords, vendors may register callbacks on the DC to plugin their algorithm. These callback functions will return the dynamically calculated passcodes for the user at a specific point in time. This passcode will then be treated as a normal password by the DC.