Matrix Authentication Pattern Seed Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional matrix authentication systems are vulnerable to password leakage due to network tapping, as information about pattern element sequences can be used to estimate presentation patterns, leading to potential exposure of one-time-password derivation rules.
Innovation Solution
A user authentication system that generates a pattern seed value based on a user ID, which is used to create a unique presentation pattern on the client-side, reducing the risk of password exposure by not transmitting the pattern element sequence over the network and employing encryption algorithms like symmetric-key encryption or hash functions to secure the pattern element sequence creation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the pattern element sequence is transmitted over the network from server to client, then the client can create the presentation pattern for authentication, but the system becomes vulnerable to network tapping and password leakage
Solution Approach 1:
The patent extracts the critical secret information (pattern element sequence) from the network transmission path and keeps it locally stored on the client device. Only the result (presentation pattern) is displayed to the user, while the underlying sequence remains isolated from network vulnerabilities, effectively removing the attack vector for network tapping.
Solution Approach 2:
The patent introduces an intermediary mechanism where the client device acts as a secure local storage and processing unit. The pattern element sequence is stored locally on the client rather than being transmitted over the network, and the client independently generates the presentation pattern using local computation, thereby mediating between the authentication server and the user interface while eliminating network exposure of sensitive data.
2Ease of operation
If the presentation pattern is created using a fixed password-based challenge/response scheme, then authentication can be performed, but the fixed password is highly likely to be analogized and stolen during input operation
Solution Approach 1:
The patent transforms the static fixed password into a dynamic presentation pattern that changes with each authentication attempt. The pattern element sequence is processed locally to generate unique presentation patterns, and the one-time password is derived dynamically from the user's secret combined with the current pattern state, making each authentication instance unique and preventing password analogy attacks.
Solution Approach 2:
The patent changes the parameter of password representation from a fixed string to a dynamically generated visual pattern. The presentation pattern uses spatial arrangement and visual elements rather than traditional text input, fundamentally changing how the password is expressed and entered, thereby eliminating the risk of shouldering attacks and keyboard logging.
3Reliability
If dedicated software is installed on the client to generate the response, then the challenge/response authentication can function, but the system complexity increases and deployment becomes harder
Solution Approach 1:
The patent designs the pattern element sequence storage and presentation pattern generation to work across multiple platforms and browsers without requiring dedicated software installation. By using standard web technologies and local storage mechanisms available in modern browsers, the system achieves universal compatibility while maintaining the security benefits of local pattern storage and processing.
Solution Approach 2:
The patent enables the client device to autonomously store and process the pattern element sequence using its own local storage capabilities and computation resources. The browser or operating system's built-in storage and processing functions are utilized, eliminating the need for additional dedicated software while allowing the client to self-manage its authentication credentials securely.
Data Source
AI summary
Disclosed is a user authentication system, which is designed to present a presentation pattern to a user subject to authentication, and apply a one-time-password derivation rule serving as a password of the user to certain pattern elements included in the presentation pattern at specific positions so as to create a one-time password. An authentication server is operable to generate a pattern seed value adapted to be combined with a user ID so as to allow a presentation pattern to be uniquely determined, and transmit the generated pattern seed value to an authentication-requesting client. The authentication-requesting client is operable to display a presentation pattern created based on an entered user ID and the received pattern seed value and in accordance with a given pattern-element-sequence creation rule, so as to allow the user to enter therein a one-time password, and transmit the entered one-time password to the authentication server. The authentication server is operable to duplicate the presentation pattern so as to create a verification code, and compare between the received one-time password and the created verification code, so as to carry out user authentication. The present invention provides a matrix authentication scheme capable of reducing the risk of password leakage.