Multi-Channel Random Partial Shared Secret Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication systems face challenges in providing robust security, particularly in remote access scenarios, as they are vulnerable to intrusions and channel preemption, and lack effective mitigation against entropy leakage and conventional attacking techniques.
Innovation Solution
The implementation of a multi-channel, random partial shared secret recognition system that uses two data processing machines with different communication channels for authentication, where a random subset of the authentication credential is challenged and responded to, enhancing security through cognitive association and dynamic credential generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional single-channel authentication is used, then the system is simpler to implement, but it is vulnerable to channel preemption and entropy leakage attacks
Solution Approach 1:
The authentication credential is segmented into multiple parts, with different parts transmitted through different communication channels. The server divides the authentication process into multiple stages, each using a different channel, thereby preventing single-point compromise and reducing entropy leakage in any single channel.
Solution Approach 2:
The system transitions from single-channel authentication to multi-channel authentication by adding temporal and spatial dimensions to the authentication process. Multiple communication channels (e.g., SMS, email, voice call) are used sequentially or in parallel, creating a multi-dimensional authentication space that is harder to compromise.
2Reliability
If multi-factor authentication is implemented, then security is enhanced, but usability deteriorates due to multiple authentication factors to remember
Solution Approach 1:
The system automatically manages multiple authentication factors without requiring user intervention to remember them. The server handles the distribution and coordination of different authentication credentials across multiple channels, making the complex multi-factor authentication process transparent to the user.
Solution Approach 2:
Authentication credentials are pre-distributed to multiple channels before the authentication event. Users receive authentication information in advance through different channels (e.g., SMS code sent before login), eliminating the need to remember multiple complex credentials during the authentication moment.
3Productivity
If complete authentication credentials are transmitted through a single channel, then the transmission is simpler, but entropy leakage occurs making it easier for intruders to intercept and reengineer credentials
Solution Approach 1:
The complete authentication credential is divided into multiple segments that are transmitted through different communication channels. Each channel carries only a portion of the authentication information, so even if one channel is compromised, the intruder cannot reconstruct the complete credential due to missing segments from other channels.
Solution Approach 2:
Different segments of the authentication credential are assigned to different communication channels based on their security characteristics. More secure channels carry more critical segments, while less secure channels carry less critical segments, optimizing the distribution of authentication information according to local channel qualities.
Data Source
AI summary
Random partial shared secret recognition is combined with using more than one communication channel between server-side resources and two logical or physical client-side data processing machines. After a first security tier, a first communication channel is opened to a first data processing machine on the client side. The session proceeds by delivering an authentication challenge, identifying a random subset of an authentication credential, to a second data processing machine on the client side using a second communication channel. Next, the user enters an authentication response in the first data processing machine, based on a random subset of the authentication credential. The authentication response is returned to the server side on the first communication channel for matching. The authentication credential can be a one-session-only credential delivered to the user for one session, or a static credential used many times.