Multi-Factor Authentication Using Offset-Adjusted Time
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multi-factor authentication processes often fail due to clock drifts or time synchronization issues between computing devices and systems, leading to authentication errors despite the use of correct shared codes.
Innovation Solution
An authentication application on the computing device proactively determines timing synchronization errors and generates a subsequent authentication code using a synchronized authentication application time based on a current device time and an offset parameter value, which is updated to mitigate synchronization issues without requiring user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the authentication code is generated using device time, then the authentication process is simple and fast, but authentication failures occur due to clock drift between device and system time
Solution Approach 1:
The patent changes the time parameter from raw device time to offset-adjusted time. The authentication code is generated using the formula: authentication code = hash(shared secret + device time + offset). The offset parameter compensates for clock drift by adjusting the device time to match system time, thereby resolving authentication failures while maintaining the simplicity of time-based authentication
Solution Approach 2:
The system implements a feedback mechanism where the server returns an offset value to the client after authentication attempts. This offset is calculated based on the time difference between server time and device time. The client stores and applies this offset in subsequent authentication attempts, creating a closed-loop system that automatically corrects time synchronization issues
2Reliability
If manual time synchronization is required, then time accuracy can be ensured, but user burden and authentication process complexity increase
Solution Approach 1:
The authentication application performs time synchronization automatically without requiring user intervention. The system autonomously retrieves the offset value from the server, stores it locally, and applies it to all authentication code generations. This self-service mechanism ensures time accuracy while maintaining ease of operation for users
Solution Approach 2:
The system performs time synchronization preparation in advance by obtaining the offset value before authentication is needed. The offset is stored and ready for use, so when authentication is required, the correct time-adjusted authentication code can be generated immediately without requiring real-time user intervention or manual synchronization
3Measurement precision
If the offset parameter is updated frequently, then time synchronization accuracy is maintained, but network communication overhead increases
Solution Approach 1:
The system updates the offset parameter periodically rather than continuously. The authentication application retrieves the offset value at scheduled intervals or when triggered by specific events (e.g., authentication failure, elapsed time threshold). This periodic update approach maintains time synchronization precision while minimizing network communication overhead by avoiding unnecessary frequent updates
Data Source
AI summary
A method comprises sending, from an authentication application deployed on a second computing device to the system, a first authentication code generated from a shared code and an authentication application time, the shared code being code previously shared between the second computing device and the system, the authentication application time based on a first current device time of the second computing device and an offset parameter value. The method further comprises receiving an authentication error message from the system; responsive to the message, determining a timing synchronisation measure between the application time and system time; determining an offset parameter value based on the timing synchronisation measure; determining a synchronised authentication application time based on a subsequent current device time of the second computing device and the updated offset parameter value; and sending, to the system, a second authentication code generated from the shared code and the synchronised authentication application time.