Local One-Time Password Authentication via Hashed Candidate Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems, such as Kerberos, rely on static user passwords for security, which is insufficiently strong, and one-time password (OTP) systems require external verification computers, making them inflexible and costly to deploy within local computing environments.
Innovation Solution
A local computing domain employs a one-time password (OTP) server that works in conjunction with an authentication server to generate and verify OTPs, minimizing changes to existing authentication functions and keeping sensitive OTP functions separate from the local environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based authentication is used, then the system is simple to implement, but the security protection is weak
Solution Approach 1:
The authentication system is divided into two independent components: a token device that generates OTPs and a verification computer that validates them. This segmentation allows the complex OTP generation functionality to be separated from the local authentication system, providing strong security without requiring the entire OTP system to be deployed locally.
Solution Approach 2:
A centralized OTP verification service acts as an intermediary between the local authentication system and the OTP generation/validation functionality. This mediator handles the complex OTP verification processes remotely, allowing the local system to benefit from strong OTP-based authentication without implementing the full OTP infrastructure locally.
2Reliability
If OTP verification computer is deployed externally, then strong authentication is provided, but the deployment flexibility and cost-effectiveness are reduced
Solution Approach 1:
The complex OTP verification computer functionality is extracted from the local authentication environment and implemented as a separate, remotely accessible service. This extraction allows the local system to obtain strong OTP-based authentication without bearing the cost and complexity of deploying full OTP verification infrastructure locally.
Solution Approach 2:
The external OTP verification service is designed to serve multiple authentication systems and clients through a standardized interface. This universal service can be shared across different local authentication environments, providing strong authentication capabilities to multiple systems without requiring separate OTP infrastructure for each, thereby improving cost-effectiveness and deployment flexibility.
Data Source
AI summary
A computing system has a local computing domain coupled to a one-time password (OTP) server. The OTP server maintains user-specific secret data used in a one-time-password (OTP) process to generate OTPs for user authentication. An authentication server in the computing domain sends an OTP request identifying a user to the OTP server. The OTP server executes the OTP process to generate a set of candidate OTPs, any one of which is expected to match a user-generated OTP for a valid authentication. The OTP server returns a response to the authentication server which includes second hashed OTP values, each generated by applying a hash function to a respective candidate OTP. The authentication server performs a comparison function between a first hashed OTP value from the user and the second hashed OTP values. Only upon determining that the first hashed OTP value matches one of the second hashed OTP values, the authentication server performs a protected function in the computing domain that is permitted only upon authentication of the user. Applications include authentication in a ticket-based authentication scheme such as a Kerberos system, in which the protected function may be the granting of a ticket-granting ticket enabling the user to engage service servers in the computing domain.