Offline User Account Authentication via Segmented QR Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems require an active network connection to authenticate devices and user accounts, which can fail due to intermittent or unreliable internet connections, and may not be feasible with data limitations in optical systems, especially when using two-dimensional QR codes that cannot communicate large amounts of data required for secure authentication.
Innovation Solution
A method that allows device and user account authentication without an active network connection by generating and using authentication codes offline, using previously received authentication data, and sending these codes to local computing devices for verification, with encryption and security techniques to prevent fraudulent use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication systems use optical codes (QR codes) for device and user account authentication, then authentication can be performed without active network connection, but the data capacity of optical codes is insufficient to communicate large amounts of data required for secure authentication
Solution Approach 1:
The authentication data is divided into two parts: a compact optical code (QR code) containing essential authentication information, and a separate authentication data store containing additional data. This segmentation allows the optical code to remain within data capacity limits while still enabling secure authentication without network connection.
Solution Approach 2:
The patent introduces an intermediary authentication data store that bridges the gap between the limited-capacity optical code and the full authentication data requirements. This intermediary component allows the system to overcome the data capacity limitation of optical codes while maintaining the benefit of offline authentication capability.
2Reliability
If authentication systems require active network connection, then secure communication can be maintained, but authentication fails due to intermittent or unreliable internet connections
Solution Approach 1:
The system performs preliminary authentication actions by receiving and storing authentication data in advance during network-connected periods. This preliminary action enables the device to authenticate securely without network connection during subsequent offline periods, thus maintaining both security and availability.
Solution Approach 2:
The authentication system becomes self-sufficient by storing authentication data locally in the authentication data store. This self-service capability allows the device to perform authentication independently without requiring continuous network connection, thereby maintaining authentication availability during intermittent connectivity conditions.
3Productivity
If authentication codes are made valid for extended period, then authentication availability improves, but security risks increase due to potential theft or fraudulent use
Solution Approach 1:
The authentication code's validity period is made dynamic rather than static. The code is valid only for a limited time window, and its validity can be extended or renewed based on authentication success. This dynamic approach balances availability and security by preventing permanent validity while allowing temporary access during legitimate authentication attempts.
Solution Approach 2:
The system implements feedback mechanisms where authentication success or failure affects code validity. Successful authentication can extend code validity, while failed attempts may invalidate the code. This feedback loop allows the system to adapt code validity to actual usage conditions, maintaining security while enabling availability during legitimate operations.
Data Source
AI summary
Methods for authenticating a user account are generally described. In various examples, the methods may comprise performing a first handshake comprising sending authentication data to a first computing device. The authentication data may include a handshake identifier, a user token, and an encryption key. In some examples, the methods may further comprise storing the handshake identifier, the user token, and the encryption key in a database. The methods may further comprise receiving a request for verification of a transaction. The request may comprise the handshake identifier and an encrypted user token. The user token and the encryption key may be retrieved from the database based at least in part on the handshake identifier of the request. The encryption key may be used to decrypt the encrypted user token. A determination may be made that the decrypted user token matches the user token retrieved from the database.