Mobile Token Shared Secret Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication and one-time passwords with fixed passwords are vulnerable to hacking, difficult for users to remember, and lead to insecure access across multiple applications, while traditional identity management systems are inadequate for the interconnected world, especially with the rise of network-connected devices.
Innovation Solution
A method for establishing a shared secret between devices without shared trust, where a user is identified by a service provider, an activation code is requested and verified, and a shared secret is generated and stored on a first device, then transferred to a second device, ensuring secure authentication and transaction signing, even in the absence of shared trust.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If fixed passwords are used for authentication, then ease of operation is improved, but reliability deteriorates due to vulnerability to hacking and user tendency to reuse passwords
Solution Approach 1:
The authentication system is segmented into multiple components: a secret value stored on the server, a counter synchronized between server and client, and a one-time password generated by combining these elements. This segmentation ensures that even if one component is compromised, the entire system remains secure because the OTP changes with each use.
Solution Approach 2:
The patent implements dynamic authentication where the password changes with each use based on the counter value. The OTP is generated dynamically using the formula OTP = f(secret, counter), where the counter increments with each authentication attempt. This dynamic nature eliminates the static vulnerability of fixed passwords.
2Reliability
If one-time passwords are implemented, then reliability is improved, but device complexity increases due to the need for synchronization and secret management
Solution Approach 1:
The patent uses a simplified copying mechanism where the client device maintains a local copy of the counter value that is synchronized with the server. Instead of implementing complex cryptographic protocols, the system copies and increments the counter locally, generating OTPs that match the server's expectations without requiring complex key management or synchronization protocols.
3Ease of operation
If traditional identity management systems are used, then ease of operation is maintained, but adaptability deteriorates for the interconnected world and network-connected devices
Solution Approach 1:
The one-time password system is designed with universal applicability across multiple devices, applications, and service providers. The same authentication mechanism can be deployed on mobile devices, computers, and IoT devices, and can integrate with various service providers through the standardized OTP interface. The system is not locked into proprietary technology or vendor-specific implementations.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
The present invention relates to a method for establishing a shared secret between a first and a second device (1, 2) without any shared trust between the first and second device, for the use of services provided by a service provider (3') to a user (4) of the second device (2), where the user (4) of the second device (2) is identified (11) by the service provider (3), the second device (2) request (12) and receive an activation code from the first device (1), the user (4) of the second device send (13) the activation code to the service provider (3), the service provider (3) send (14) the activation code to the first device (1), the first device (1) confirm the activation code and generate and store the shared secret (15), the first device (1) generate a reference to the shared secret and transfer (16) the reference and shared secret to the second device (2), the first device (1) transfer (19) the reference to the service provider (3), and the service provider (3) store (110) the reference and associate the reference to the user (4).