One-Time Passcode Authentication with Embedded Security Signals

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing one-time authentication token systems are vulnerable to seed leakage attacks, which can lead to token compromise and impersonation, as they lack an end-to-end server-side architecture that simultaneously supports split-server verification, silent alarms, and drifting keys.

Innovation Solution

Implementing a server-side architecture that embeds silent alarm and drifting key signals into one-time authentication passcodes, allowing for the extraction of auxiliary information to enforce predefined access policies, thereby detecting potential token compromise and cloning, and enhancing server security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional one-time authentication token systems are used, then authentication functionality is provided, but the systems are vulnerable to seed leakage attacks and lack comprehensive security mechanisms

Engineering Contradiction:

Improvesecurity against seed leakage attacksVSAvoidserver-side architecture complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication system is segmented into multiple independent components: split-server verification (dividing the verification process across multiple servers), silent alarm mechanism (separate detection channel for compromise), and drifting key mechanism (independent key evolution system). Each component addresses a specific security concern without requiring complete system redesign, thereby improving reliability while managing complexity through modular architecture.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent embeds multiple security mechanisms within the authentication token and server architecture. The silent alarm and drifting key signals are nested within the authentication passcode structure, allowing multiple security functions to operate simultaneously within a unified framework. This nesting approach enhances security without proportionally increasing external system complexity.

Inventive Principle:

Principle #7Nested doll (Nesting)

2Reliability

If split-server verification is implemented, then protection against server-side seed leakage is improved, but the system lacks integrated silent alarm and drifting key capabilities

Engineering Contradiction:

Improveprotection against server-side seed leakageVSAvoidintegration of multiple security mechanisms

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The authentication server is designed with multi-functionality to handle diverse security operations: split-server verification for seed protection, silent alarm processing for compromise detection, and drifting key validation for cloning detection. This universal server architecture can process multiple types of authentication requests and security checks through a unified interface, enhancing adaptability while maintaining the benefits of split-server verification.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent combines previously separate security mechanisms (split-server verification, silent alarm, drifting key) into an integrated authentication system. The server architecture merges these functions by processing multiple security signals simultaneously during the authentication process, allowing the system to benefit from all mechanisms working together rather than in isolation.

Inventive Principle:

Principle #5Merging (Combining)

3Measurement precision

If auxiliary information is embedded in passcodes, then detection capability against token compromise is enhanced, but the processing complexity of authentication requests increases

Engineering Contradiction:

Improvedetection of token compromise and cloningVSAvoidpasscode processing complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The server extracts auxiliary information (silent alarm signals and drifting key signals) from the authentication passcode during the verification process. By separating the extraction and processing of these security signals from the main authentication logic, the system achieves precise detection of token compromise and cloning while managing processing complexity through dedicated extraction routines that operate on specific portions of the passcode.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS10673832B2Predefined access policy implementation based on auxiliary information embedded in one-time authentication passcodes

Publication Date: 2020.06.02 RSA SECURITY USA LLC

AI summary

Techniques are provided for implementing predefined access policies based on auxiliary information embedded in one-time passcode authentication tokens. An exemplary method comprises receiving an authentication passcode generated by a token of a user, wherein the received authentication passcode is derived from a secret seed and based on at least one protocode and embedded auxiliary information; processing the received authentication passcode to extract the embedded auxiliary information from the received authentication passcode, wherein the embedded auxiliary information comprises (i) a silent alarm signal indicating a potential compromise of the token, and (ii) a drifting key signal indicating a current drifting key state of the token, wherein the drifting key signal is processed to detect a cloning of the token; and implementing a predefined access policy (e.g., replace or disable the token of one or more users) based on respective values of the silent alarm signal and the drifting key signal.