One-Time Password Encryption via Asymmetric Shared Secrets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password systems face challenges in security and user convenience, particularly when users misplace or lose the seed used to generate passwords, leading to authentication failures.
Innovation Solution
The use of asymmetric cryptography and shared secrets between user devices and computer-implemented services to encrypt and manage one-time passwords, where the service generates and encrypts passwords using the user's public key or a shared secret, preventing exposure of the password seed and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users are provided with password seeds for one-time password generation, then users can generate passwords independently, but users may misplace or lose the seed leading to authentication failures
Solution Approach 1:
The patent extracts the password seed from the user's control and places it under service control. The service generates and encrypts one-time passwords using the user's public key, eliminating the need for users to possess and manage seed phrases. This resolves the contradiction by removing the reliability risk of seed loss while maintaining user independence in the authentication process.
Solution Approach 2:
The patent introduces an intermediary - the service's encryption system using public-key cryptography. Instead of directly providing seeds to users, the service encrypts passwords with the user's public key as an intermediary mechanism. This allows users to receive and use passwords without ever seeing or storing the seed, resolving the reliability issue while preserving ease of operation.
2Reliability
If the service stores encrypted one-time passwords using user public keys, then authentication security is enhanced, but device complexity increases
Solution Approach 1:
The patent uses cryptographic key pairs where the public key is copied and distributed to users for encryption, while the private key is kept as a unique copy under service control. This copying mechanism enables secure password encryption without requiring complex distributed key management systems, as each user has their own key pair that can be independently managed.
Solution Approach 2:
The patent segments the authentication system into independent user key pairs and a centralized service verification component. Each user's encryption is independent, allowing the service to store encrypted passwords without managing complex interdependencies. This segmentation reduces overall system complexity while maintaining high security through individual user key management.
3Adaptability or versatility
If the service uses shared secrets for password encryption, then access control is improved, but the risk of unauthorized access increases if the shared secret is compromised
Solution Approach 1:
The patent transitions from symmetric shared secrets to asymmetric cryptography. Each user has a unique public-private key pair where the public key is shared for encryption and the private key is kept secret for decryption. This asymmetry eliminates the risk of shared secret compromise affecting all users, as each user's encryption is independent and controlled by their own key pair.
Solution Approach 2:
The patent extracts the secret decryption capability from the shared pool and assigns it individually to each user through their private key. The service stores encrypted passwords using public keys, and only the corresponding private key can decrypt them. This extraction eliminates the vulnerability of shared secret compromise while maintaining flexible access control through individual user key management.
Data Source
AI summary
A computer-implemented service uses information associated with a client device to generate a first shared secret. The service receives, from the client, a claim of access to a second shared secret and determines whether the first shared secret and the second shared secret match. If the shared secrets match, the service uses the first shared secret to encrypt a one-time password. The service provides the encrypted one-time password to the client device. The client device transmits a claim of access to the one-time password, which the service uses to determine whether the claim of access to the one-time password indicates access to the one-time password. If the claim of access to the one-time password indicates that the client device has access to the one-time password, the service allows the client device to access the service.