Mobile Platform Token Code Authentication via Segmented Day Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems for mobile devices are ineffective when the authentication server is unavailable or if the device is lost/stolen, as they rely on remote server verification, which can lead to impersonation risks if the token falls into the wrong hands.
Innovation Solution
A method that processes authentication information using cryptographic operations to generate output components for identifying authentication information and encryption/decryption keys, allowing offline authentication by storing day files on the mobile device, which include encrypted secrets and pepper values, enabling secure access to data and applications without relying on continuous network connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication information is stored on the mobile device for offline authentication, then authentication availability is improved, but security against impersonation attacks deteriorates
Solution Approach 1:
The authentication system is segmented into multiple components: authentication information is divided into encrypted segments stored in day files, and the decryption key (pepper value) is stored separately. This segmentation ensures that even if day files are compromised, the attacker cannot decrypt the authentication information without the pepper value, thus resolving the contradiction between availability and security.
Solution Approach 2:
The pepper value acts as an intermediary element that bridges the encrypted authentication information and its decryption. By introducing this intermediate secret that must be present for decryption to work, the system enables offline authentication while preventing impersonation attacks, as the pepper value never leaves the device and cannot be transmitted to attackers.
2Adaptability or versatility
If the authentication server is unavailable, then network connectivity requirements are reduced, but authentication reliability deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-generating and storing multiple day files containing encrypted authentication information for future offline use. This preliminary preparation enables the device to authenticate users offline without server connectivity, while the pre-computed encrypted data maintains authentication reliability through cryptographic security.
3Reliability
If encryption keys are stored on the mobile device for data protection, then data security is improved, but device security deteriorates if the device is lost or stolen
Solution Approach 1:
The encryption key material is segmented into two separate components: the encrypted authentication information stored in day files and the decryption key (pepper value) stored separately in secure storage. This segmentation ensures that if the device is lost or stolen, attackers cannot access both components simultaneously, thus protecting data while maintaining data protection capability.
Solution Approach 2:
The pepper value is extracted and stored in a separate secure location (secure storage or keychain) distinct from the day files. This extraction separates the critical decryption key from the encrypted data, ensuring that device loss does not compromise data security, while the separated key remains available for legitimate authentication operations.
Data Source
AI summary
Methods, apparatus and articles of manufacture for using a token code to control access to data and applications in a mobile platform are provided herein. A method includes processing authentication information via a cryptographic operation to generate an output, partitioning the output into (i) a component that identifies the authentication information and (ii) an encryption key component, encrypting an item of cryptographic information via the encryption key component, and storing the component that identifies the authentication information and the encrypted item of cryptographic information.