Offline One-Time Passcode Authentication via Local Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems for secure data are vulnerable to unauthorized access due to weak password entropy and require periodic connections to remote servers for OTP verification, making them susceptible to attacks and inconvenient for offline use.
Innovation Solution
A method and system that generate and manage encrypted key versions using a sequence of code values, allowing for offline OTP authentication without relying on a remote server, by decrypting and re-encrypting keys locally, enhancing security and usability through increased entropy and reduced dependency on remote servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If periodic connections to remote servers are required for OTP verification, then security is maintained through centralized control, but system availability and convenience for offline use deteriorate
Solution Approach 1:
The system segments the authentication functionality by separating the OTP verification capability from the remote server dependency. Local encrypted key versions are stored and can be independently decrypted using locally-generated code values, enabling the device to function autonomously offline while maintaining security through the distributed key management architecture.
Solution Approach 2:
Encrypted key versions are generated and stored in advance before offline operation is needed. These pre-computed encrypted key versions can be decrypted immediately using locally-generated code values without requiring real-time server connection, thus preparing the system for offline authentication in advance.
2Ease of operation
If alphanumeric passwords are used for access control, then ease of input is improved, but security entropy deteriorates making systems vulnerable to shoulder-surfing attacks
Solution Approach 1:
A code value generator acts as an intermediary between the user and the authentication system. Instead of directly entering passwords, users interact with the generator to produce code values that are then used for authentication. This intermediary layer enhances security by transforming low-entropy passwords into high-entropy code values while maintaining user convenience through automated generation.
Solution Approach 2:
The system transforms the password parameter from a static alphanumeric string into a dynamic code value with higher entropy. By changing the parameter from a simple password to a time/event-dependent code value, the system maintains ease of input while dramatically improving security against shoulder-surfing and brute-force attacks.
3Reliability
If cryptographic keys are made sufficiently long to provide high entropy, then security is improved, but key management complexity and storage requirements worsen
Solution Approach 1:
The cryptographic key management is segmented into multiple encrypted key versions, each protected by a different code value. Instead of managing one long complex key, the system manages multiple encrypted versions that can be independently decrypted. This segmentation reduces the operational complexity of key management while maintaining high security entropy through the underlying cryptographic key length.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention provides methods of, and computer programs and systems for, controlling access to a resource via a computing device configured to perform a method that enables new encrypted versions of a key, encrypted with code values in a sequence of code values that are valid at a future time, to be provided and made available for future performance of the method. This in turn enables a method of user verification that does not require access to a remote server in order to provide one-time passcode verification, and so provides an offline one-tome passcode authentication method that is self-sustaining.