Login Key Authentication for Account Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user account login methods are vulnerable to hacking, as attackers can use login programs to try numerous passwords, compromising account security by exploiting loopholes in the server's authentication process.
Innovation Solution
The proposed solution involves a computer server that authenticates login requests by including a third field for a login key in the login request message, using a preset key generation algorithm to generate and compare login keys, and optionally generating a verification code to ensure the request is legitimate, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server uses traditional username and password authentication, then the login process is simple and fast, but the account security is vulnerable to hacking attempts
Solution Approach 1:
The server performs preliminary actions by generating a login key in advance and sending it to the user's terminal before the actual login attempt. This preliminary key distribution enables the terminal to pre-compute the login key signature, so that during login authentication, the server can quickly verify the signature without complex real-time computation, thus enhancing security while maintaining authentication efficiency
Solution Approach 2:
The login key serves as an intermediary element between the user and the server authentication process. Instead of directly verifying passwords, the system uses the login key and its signature as a mediator to authenticate user identity. This intermediary mechanism enhances security by adding an additional verification layer without significantly complicating the overall authentication flow
2Reliability
If the server verifies login keys for every login request, then account security is improved, but the authentication processing time increases
Solution Approach 1:
The computationally intensive key signature generation is performed in advance on the user's terminal using the pre-distributed login key. During actual login authentication, the server only needs to verify the pre-generated signature, which is a much faster operation. This preliminary computation approach shifts the time-consuming operation away from the server's real-time authentication process, thus maintaining both security and speed
3Productivity
If the terminal stores login keys locally, then authentication speed is improved, but the risk of key leakage increases
Solution Approach 1:
The system changes the parameter of the login key by periodically updating and refreshing it. Instead of using a static long-term key, the login key is dynamically updated, which limits the window of opportunity for attackers even if a key is compromised. This parameter change strategy allows the terminal to store keys locally for fast authentication while mitigating the security risk through frequent key rotation
Solution Approach 2:
The login key undergoes periodic updates and refreshes. This periodic action ensures that even if a key is stolen or leaked, its validity period is limited, reducing potential damage. The regular key updates maintain authentication speed by keeping keys readily available on the terminal while systematically reducing accumulation of security risk over time
Data Source
AI summary
A computer server receives a login request message sent by a remote terminal to access a user account. If the message includes a first login key, the server then generates a second login key and executes a user account login process after confirming that the second login key corresponds to the first login key. If the message includes no login key, the server generates a verification code and returns the verification code to the remote terminal. The remote terminal then prompts a user to return the verification code to the computer server in a predefined format. If the returned verification code corresponds to the server-generated verification code, the server then executes the user account login process. The server also generates a third login key and returns the third login key to the remote terminal. The remote terminal then stores a correspondence relationship between the username and the third login key.