One-Time Password Authentication via Centralized Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current username/password authentication is vulnerable to eavesdropping and brute force attacks, and existing security measures like digital certificates and one-time passwords require a trust relationship and impose significant burdens, making them impractical for widespread use among arbitrary parties.
Innovation Solution
A system that uses a centralized authentication service to generate and manage one-time passwords, where clients receive a personal moniker that is used to obtain a one-time password, which is then redeemed for authentication, reducing the need for shared information and minimizing the risk of credential exposure in case of a security breach.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital certificates and public/private key pairs are used for authentication, then authentication security is improved, but device complexity and processing overhead increase significantly
Solution Approach 1:
The authentication process is segmented into two distinct phases: enrollment (where digital certificates are issued) and authentication (where one-time passwords are used). This segmentation allows the system to benefit from the security of digital certificates without requiring them to be used for every authentication transaction, thereby reducing processing overhead.
Solution Approach 2:
The system performs preliminary action by establishing trust relationships and issuing digital certificates during an enrollment phase before actual authentication occurs. This preliminary setup enables subsequent authentication to use simpler one-time passwords without requiring real-time certificate verification for each login attempt.
2Reliability
If one-time passwords are used for maximum security, then authentication security is improved, but ease of operation deteriorates due to synchronization requirements
Solution Approach 1:
The authentication service acts as an intermediary that manages one-time password generation and verification. This mediator handles the complex synchronization logic, allowing clients to simply request and use one-time passwords without needing to understand or manage the underlying synchronization mechanisms.
Solution Approach 2:
The system implements self-service by allowing clients to automatically obtain one-time passwords from the authentication service without manual intervention. The authentication service automatically generates, distributes, and validates one-time passwords, eliminating the need for users to manually synchronize with remote devices.
3Reliability
If trust relationships are required between parties, then authentication reliability is improved, but adaptability deteriorates for arbitrary parties
Solution Approach 1:
The authentication service provides a universal platform that enables arbitrary parties to establish secure authentication relationships without pre-existing trust. The service acts as a trusted third party that can facilitate authentication between any clients and service providers, making the system universally applicable rather than limited to specific trusted pairs.
Solution Approach 2:
The authentication service serves as an intermediary that mediates between clients and service providers, eliminating the need for direct trust relationships between them. The service verifies client identities and issues one-time passwords, allowing any party to authenticate with any service through the intermediary without requiring prior trust establishment.
4Reliability
If encryption keys are rotated periodically, then security against breaking is improved, but loss of time increases due to key management overhead
Solution Approach 1:
The system implements periodic action by rotating encryption keys and issuing new one-time passwords after each use or after defined time periods. This periodic rotation ensures that even if one key is compromised, the damage is limited to a single authentication instance, while the automated nature of the rotation minimizes manual key management overhead.
Data Source
AI summary
Systems, computer program products and methods for authentication using a one-time password. In system that includes a client, a service provider, and an authentication service, the authentication service generates an authentication service identifier for the client. Any suitable identifier may be used for the authentication service identifier, which generally takes the form of an arbitrary number of characters. From the client, the authentication service receives a client moniker (e.g., a username) for the client to use when accessing the authentication service. The authentication service sends a one-time password to the client for the client to use in accessing the service provider. When the authentication service receives a one-time password from the service provider, the authentication service sends the authentication service identifier for the client to the service provider to authenticate the client if the one-time password received from the service provider matches the one-time password sent to the client.