Mobile Device One-Time Password Generation via Diffie-Hellman
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often reuse the same identifiers and secrets across multiple services, making it easy for malicious entities to access sensitive information, and traditional security measures like external hardware devices are cumbersome and inconvenient.
Innovation Solution
A mobile communication computing device, such as a cellular telephone or personal digital assistant, generates single-use passwords using cryptographic protocols like Diffie-Hellman, allowing users to authenticate securely across different service providers without the need for additional hardware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users reuse the same identifier and secret across multiple services, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent segments the authentication secret into multiple components: a long-term shared secret stored securely in the mobile device and a one-time password generated for each authentication event. This segmentation allows the system to maintain security while improving ease of use, as users only need to enter the one-time password without managing complex permanent passwords across multiple services.
Solution Approach 2:
The patent implements disposable one-time passwords that are generated, used, and then discarded. Each password is valid for a single authentication event, making it useless if intercepted. This approach maintains high security while improving ease of operation, as users can easily generate new passwords without worrying about long-term security management.
2Reliability
If users select complex passwords with many characters and numerals, then security is improved, but ease of operation is worsened
Solution Approach 1:
The mobile device automatically generates and manages complex cryptographic secrets and one-time passwords without requiring user input or memorization. The system performs the complex security operations itself, presenting only simple one-time codes to the user for entry. This resolves the contradiction by maintaining strong security through automated complex operations while preserving ease of use through simple user interactions.
3Reliability
If external hardware devices are used to generate single use passwords, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent leverages the mobile device's existing cryptographic capabilities and processing power to perform authentication functions that would traditionally require separate hardware devices. The mobile device universally handles multiple functions including secure key storage, cryptographic operations, and one-time password generation, eliminating the need for additional dedicated hardware security devices while maintaining strong security.
Solution Approach 2:
The patent combines the authentication security functions with the mobile device that users already possess and trust. By merging the one-time password generation capability into an existing universally-owned device rather than requiring separate hardware tokens, the system maintains high security while reducing overall device complexity and user burden.
Data Source
AI summary
Single-use character combinations are a secure mechanism for user authentication. Such “one-time passwords” (OTPs) can be generated by a mobile device to which the user otherwise maintains easy access. A key exchange, such as in accordance with the Diffie-Hellman algorithm, can provide both the mobile device and a server with a shared secret from which the OTPs can be generated. The shared secret can be derived from parameters posted on the server and updated periodically, and the mobile device can obtain such parameters from the server before generating an OTP. Such parameters can also specify the type of OTP mechanism to be utilized. A second site can, independently, establish an OTP mechanism with the mobile device. For efficiency, the first server can provide an identity token which provides the mobile device's public key in a trusted manner, enabling more efficient generation of the shared secret with the second server.