Mobile Authenticator Single Sign-On via One-Time Password Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods for mobile devices are cumbersome and insecure, especially when users access different networks, as they require remembering and entering passwords for various applications, and standard techniques assume a secured corporate network, which is not always true.
Innovation Solution
A system that uses a client-side authenticator and a server-side register to generate and share a secret key, allowing for secure single sign-on authentication through a mobile device, where the user only needs to enter a device PIN, and the authenticator generates One-Time-Password tokens for access requests, ensuring that untrusted applications do not access private credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users remember and enter passwords for various different applications on mobile devices, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent introduces an authenticator application as an intermediary that manages authentication credentials. Instead of users directly managing multiple passwords, the authenticator stores credentials securely and generates one-time passwords (OTPs) for authentication, eliminating the need for users to remember and manually enter multiple passwords while maintaining security
Solution Approach 2:
The system creates a copy of the authentication credential in the form of a one-time password (OTP) that is generated by the authenticator. This OTP copy is used for authentication without exposing or requiring the user to handle the actual password, thus maintaining security while improving ease of operation
2Reliability
If standard authentication techniques are used assuming secured corporate network, then security is improved, but adaptability deteriorates
Solution Approach 1:
The patent implements dynamic authentication where the authenticator can adapt to different network conditions and authentication scenarios. The system dynamically generates one-time passwords and can operate in both secured corporate networks and unsecured public networks, adjusting its behavior based on the environment rather than assuming a fixed network condition
3Ease of operation
If users access applications through untrusted applications on mobile devices, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The authenticator serves as a trusted intermediary between untrusted applications and the user's credentials. Applications can request authentication through the authenticator without directly accessing or storing user passwords, maintaining security while enabling easy access through various applications
Solution Approach 2:
The system extracts the password management function from the applications themselves and places it in the dedicated authenticator. This separation ensures that applications cannot access or misuse credentials, as the actual password storage and management is extracted to a secure, dedicated component
Data Source
AI summary
A mobile device may include an authenticator and a processor. The authenticator may store a first secret corresponding to a second secret stored on a server and generating a key based upon the first secret. The processor may embed the key in data communicated to the server to request access from the server.