Username-less One-Time Code Authentication System

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional authentication methods, such as username/password combinations, are vulnerable to hacking, and One-Time Passwords (OTPs) require users to disclose their username, increasing the risk of identity theft.

Innovation Solution

A method using a one-time authentication and verification code (OTC) that generates a random or pseudo-random code, incorporating HOTP or TOTP, where the userLink code is used for authentication without requiring the username or password, stored securely on a token device.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional username/password authentication is used, then users can log in to systems, but the authentication is vulnerable to hacking and credential theft

Engineering Contradiction:

Improveauthentication securityVSAvoidcredential exposure risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system pre-generates one-time codes and stores them in a secure code pool before they are needed. When authentication is required, the system retrieves pre-existing codes rather than generating them on-demand, ensuring codes are always available and eliminating the need for users to remember passwords.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements disposable one-time codes that are valid for only a single authentication event. Each code is used once and then discarded, preventing replay attacks and credential theft. The codes are inexpensive to generate and replace, making the system secure without requiring complex password management.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

2Reliability

If One-Time Passwords (OTP) are used to strengthen security, then password hacking is limited, but users must still disclose their username which increases identity theft risk

Engineering Contradiction:

Improvepassword securityVSAvoidusername disclosure

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent extracts the username requirement from the authentication process. Instead of requiring users to input their username along with their OTP, the system uses the OTP itself as the sole authentication credential. The username information is eliminated from the user's input burden, preventing username disclosure while maintaining secure authentication.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The one-time code serves multiple functions simultaneously: it acts as both the authentication credential and the identifier that would traditionally require a username. This multi-functional code eliminates the need for separate username and password fields, reducing the attack surface for identity theft.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If users must enter username and password each time they log in, then authentication can be verified, but the process is time-consuming and repetitive

Engineering Contradiction:

Improveauthentication verificationVSAvoidlogin time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system prepares authentication codes in advance and stores them in a ready-to-use pool. When a user needs to authenticate, the system quickly retrieves a pre-generated code rather than performing complex verification of username and password combinations. This preliminary preparation significantly reduces authentication time while maintaining security.

Inventive Principle:

Principle #10Preliminary action

4Reliability

If strong passwords are used to protect accounts, then security is improved, but strong passwords can still be hacked and stolen

Engineering Contradiction:

Improveaccount securityVSAvoidpassword theft risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent replaces long-lived strong passwords with short-lived one-time codes. Each code is valid for only one authentication event and then becomes obsolete. This disposable approach eliminates the risk of password theft through replay attacks, credential stuffing, or database breaches, as stolen codes cannot be reused.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Solution Approach 2:

The system generates codes periodically in advance and rotates through them in sequence. This periodic generation and rotation ensures that codes are always fresh and never reused, making the system resistant to theft and replay attacks while maintaining continuous authentication capability.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS11991287B2Username-less and password-less one-time identification and authentication code method and system

Publication Date: 2024.05.21 XIID CORP

AI summary

A method for a user to access resources within a secure network without inputting a username or password is presented and claimed where the method comprises inputting, by the user, login credentials into an authentication service and obtaining from the authentication service at least one secret code; inputting the at least one secret code into an OTCP to initialize the OTCP; generating within the OTCP a one-time code (OTC) utilizing the at least one secret code but not including the user's login credentials or username; supplying, by the user, the OTC to a secure web portal wherein the secure web portal confirms authenticity of the OTC with the authentication service; and the secure web portal supplying access to the user of the secure web portal resources upon receipt of authentication of the user.