One-Time Seed Authentication for IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security measures for transactions using mobile and IoT devices are prone to hacking, as they rely on seeds and counters stored on user devices, making them vulnerable to malware and other hacking methods, which can lead to identity theft and fraudulent activities.
Innovation Solution
An authentication system that uses a one-time seed (aOTS) generated by an authentication server, which is used to create a user one-time password (uOTP) on the user device, and then verified by the authentication server, ensuring that the seed and private keys are not stored on the device, thus eliminating the risk of compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional software tokens with seed and counter are stored on user device, then authentication functionality is provided, but security is compromised due to vulnerability to hacking and malware
Solution Approach 1:
The patent extracts the seed from the user device and stores it exclusively on the server. The user device only holds a public key and generates OTPs using server-provided one-time passwords, eliminating the security vulnerability of storing seeds locally while maintaining authentication functionality.
Solution Approach 2:
The patent introduces a server as an intermediary that holds the seed and generates one-time passwords. This intermediary architecture allows the user device to authenticate without storing sensitive seed data, resolving the contradiction between providing authentication functionality and avoiding hacking vulnerabilities.
2Ease of operation
If seed and private keys are stored on user device for transaction signing, then transaction authorization is enabled, but risk of identity theft and fraudulent activities increases
Solution Approach 1:
The patent removes private keys and seeds from the user device, storing them exclusively on the server. Transaction authorization is achieved through server-generated one-time passwords and digital signatures, enabling transaction capability while eliminating the risk of private key compromise leading to identity theft.
Solution Approach 2:
The patent uses disposable one-time passwords that are generated and consumed in single transactions. Each OTP is valid for one use only and then discarded, preventing reuse attacks and eliminating the long-term security risks associated with storing reusable private keys on user devices.
3Adaptability or versatility
If malware is installed on user device, then device functionality is maintained, but security measures are compromised allowing unauthorized access to seed and counter
Solution Approach 1:
The patent extracts the seed from the user device environment entirely, making it impossible for device-installed malware to access or compromise the seed. The server exclusively controls the seed, while the user device operates with non-sensitive public keys and temporary OTPs, maintaining full device functionality without security compromise.
Data Source
AI summary
Highly secured transactions for mobile or Internet-of-Things (IoT) devices can be conducted using a one-time seed technology (OTST). For example, registration of a user and authentication of a user device is based on a one-time seed (OTS) which is generated by an authentication server and sent to the user device. The user device employs the OTS to generate a one-time password (OTP). After registration and authentication, the OTS is deleted. As such, the OTS and OTP is used only one time. No seed is stored on the user device. As for securing the transactions, it may be signed by a one-time hash (OTH) or a one-time signing key (OTSK). Like the OTS, the OTH or OTSK is deleted from the user device after the transaction. Since the user device does not contain a seed, OTH or OTSK, there is no risk of the user device being hacked by unwanted third parties.