One-Time Activation Token Generation for Unsecure Network Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional one-time authentication tokens are vulnerable to brute force and denial-of-service attacks, especially when generated based on shared credentials, and do not respect the zero-trust security principle, with tokens being short and only updated upon user initiation, providing attackers with a window to identify token values.
Innovation Solution
A method that generates a one-time activation token based on a device registration token, using a shared registration key derived from a private device key and a public server key, which is verified by comparing the device registration token to a function of the shared registration key, ensuring device verification even when not directly connected to the verification server, thus mitigating attacks while maintaining usability and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional one-time authentication tokens are used, then device verification is simplified, but security is weakened due to vulnerability to brute force and denial-of-service attacks
Solution Approach 1:
The authentication process is segmented into two distinct tokens: a device registration token (DRToken) for device identification and a one-time authentication token (TOT) for access verification. This segmentation allows the system to verify device authenticity through cryptographic verification of the DRToken while using the TOT as a temporary access credential, thereby maintaining ease of operation while significantly enhancing security against brute force and denial-of-service attacks.
2Device complexity
If authentication tokens are updated only upon user initiation, then system complexity is reduced, but security is compromised as attackers have a window to identify token values
Solution Approach 1:
The system performs preliminary authentication by verifying the device registration token (DRToken) before issuing the one-time authentication token (TOT). The DRToken is cryptographically verified against a function of the shared registration key, establishing device authenticity in advance. This preliminary verification narrows the security window by ensuring that only authenticated devices can obtain TOTs, thereby preventing attackers from intercepting or guessing valid token values.
3Adaptability or versatility
If devices connect through unsecure networks, then network accessibility is improved, but authentication reliability deteriorates due to potential interception and attacks
Solution Approach 1:
The patent introduces a verification server as an intermediary between the device and the secure service. The verification server receives the device registration token, verifies it against the shared registration key, and only then issues the one-time authentication token. This intermediary architecture allows devices to connect through unsecure networks while maintaining authentication reliability, as the critical verification process occurs through the secure verification server that mediates the authentication exchange.
Data Source
AI summary
One embodiment provides a method, including: receiving, at a server from a device, a request for device authentication across an unsecure network, the request including a device registration token; generating, at the server, a shared registration key utilizing the device registration token; verifying, at the server, the device registration token by comparing the device registration token to a function of the shared registration key; and producing, at the server and responsive to verifying the device registration token, a one-time activation token and sending the one-time activation token to the device. Other aspects are described and claimed.