Masked Grid OTP Generation for Replay Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password (OTP) systems face vulnerabilities such as replay attacks and lack of scalability in multi-device client environments, necessitating improved authentication methods.
Innovation Solution
A client-server security architecture utilizing a masked grid and seed for mutual unlocking techniques to generate and validate one-time codes (OTCs), enabling secure authentication across multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP systems are used, then authentication is provided, but the systems are vulnerable to replay attacks and lack scalability in multi-device environments
Solution Approach 1:
The system performs preliminary actions by generating and storing masked grids and seeds on client devices before authentication is needed. During enrollment, the server generates a unique masked grid and seed for each client device and stores them locally. This preliminary setup enables the client to independently generate valid OTPs without real-time server communication, preventing replay attacks since each OTP is generated fresh based on the pre-stored masked grid and seed.
Solution Approach 2:
The authentication system is segmented into independent components: the server generates and distributes masked grids and seeds to multiple client devices, and each client device independently generates OTPs using its own masked grid and seed. This segmentation allows each device to operate autonomously while maintaining security, enabling scalability across multi-device environments without centralizing the OTP generation process.
2Adaptability or versatility
If OTP systems are implemented across multiple devices, then accessibility is improved, but security consistency and scalability become challenging
Solution Approach 1:
The masked grid and seed structure serves multiple functions: it enables OTP generation, provides authentication validation, and ensures security consistency across different client devices. The universal application of the masked grid algorithm across all devices maintains security standards while allowing each device to function independently in the authentication ecosystem.
Solution Approach 2:
The masked grid acts as an intermediary between the server and the OTP generation process. During enrollment, the server provides the masked grid and seed to the client device, and this intermediary structure enables the client to generate secure OTPs independently while maintaining consistency with server-side validation, thus bridging security requirements across multi-device environments.
3Speed
If client-side OTP generation is implemented, then authentication speed is improved, but device complexity increases
Solution Approach 1:
The client device performs self-service by independently generating OTPs using its pre-stored masked grid and seed without requiring real-time server communication or complex authentication protocols. This self-service capability speeds up authentication since the OTP is generated locally and immediately, while the complexity is minimized by using a straightforward masked grid structure that the client can process autonomously.
Data Source
AI summary
A client-server security architecture is disclosed that uses a masked grid, a seed, and mutual unlocking techniques to authentication a client device with a server machine using a one-time code (OTC). The client device in the client-server architecture stores a masked grid that is used to unlock an authentication code using a seed. Once mutually unlocked, the client device may generate an OTC to attempt to authenticate the client device with a server machine. The server machine validates that OTC with the OTC stored at the server to confirm they match. Each subsequent access may repeat the aforementioned steps. Moreover, in a multi-device ecosystem, a plurality of client devices may leverage a primary client device to connect with the server machine. For example, one or more subordinate client devices may connect to the primary client device to then tunnel through to the server machine in a secure manner.