Challenge-Based One-Time Password Authentication System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password systems are vulnerable to synchronization issues and hijacking attacks, as the client device generates passwords at regular intervals, which can be energy-consuming and allow attackers to reproduce passwords using the shared secret.
Innovation Solution
A method and device that use an encryption function with a shared secret, time-dependent variable, and an additional variable that can be changed by the user, to produce one-time passwords, making it difficult for attackers to predict the password and improving system ergonomics by allowing partial password communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the client device generates passwords at regular intervals, then authentication can be performed automatically without user intervention, but energy is consumed unnecessarily and attackers can reproduce passwords using the shared secret
Solution Approach 1:
The patent implements periodic password generation only when needed, triggered by server challenges rather than continuous generation. The client device calculates passwords on-demand based on challenge timestamps, transforming continuous periodic action into event-driven periodic action that consumes energy only when authentication is required.
Solution Approach 2:
The system allows the server to trigger password generation by sending challenges to the client device. The client device serves itself by generating passwords only when challenged, eliminating the need for continuous generation and reducing energy consumption while maintaining automatic authentication capability.
2Ease of operation
If the client device generates passwords at regular intervals, then authentication is simplified, but attackers can hijack the system by capturing the shared secret
Solution Approach 1:
The patent makes the password generation dynamic by introducing challenge-based triggering and time-dependent variables. Each password is generated based on a specific challenge timestamp and sequence number, making the authentication process adaptive and unpredictable, thereby preventing hijacking while maintaining simplicity for legitimate users.
Solution Approach 2:
The system changes the parameters of password generation from fixed interval-based to challenge-based with time and sequence number variables. This parameter change ensures that even if an attacker captures the shared secret, they cannot reproduce passwords without the specific challenge parameters, enhancing security while preserving ease of operation.
3Reliability
If the client device generates passwords continuously, then authentication is always available, but energy is wasted on unnecessary password generation
Solution Approach 1:
The patent implements event-driven periodic password generation triggered only by server challenges. Instead of continuous generation, the client device generates passwords at specific intervals determined by challenge events, ensuring authentication availability when needed while eliminating energy waste during idle periods.
Solution Approach 2:
The client device autonomously determines when to generate passwords based on received challenges from the server. This self-service mechanism ensures authentication is available on-demand without continuous operation, optimizing energy usage while maintaining reliability for legitimate authentication requests.
Data Source
Figure 1
Figure 2
AI summary
The method involves providing a client device e.g. token, having a variable encryption function e.g. SHA type hashing function. A value of the function, is calculated by the client device, for authentication of a user by a server. The calculated value is provided to the server. The user is authenticated by the server by using the provided value. A request is sent to the server by the user, by using the provided value. Another value of the function is calculated by the client device, for verification of the authentication of the user by the server. An independent claim is also included for a user authentication device.