One-Time Password Authorization for IoT Blockchain Transactions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for authorizing multiparty blockchain transactions in IoT devices face security challenges due to the need for private key management, which is impractical and vulnerable to attacks, especially when using general-purpose smartphones, and incur high development and processing costs.

Innovation Solution

Implementing a one-time password (OTP) authorization system using RFID/NFC communication protocols, where IoT devices receive OTPs from user devices for transaction authorization, reducing the risk of key exposure and enabling secure multiparty transactions without requiring private key sharing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If private keys are provided to IoT devices for transaction authorization, then transaction security is improved, but device complexity and security vulnerability increase

Engineering Contradiction:

Improvetransaction securityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a one-time password (OTP) as an intermediary authorization mechanism between the user and the blockchain network. Instead of directly using private keys in IoT devices, the system uses OTPs generated by a secure device (smartphone or hardware token) that the user possesses. The OTP serves as a temporary, single-use authorization credential that proves ownership without exposing the private key, thus resolving the contradiction between security and device complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent employs one-time passwords that are short-lived and disposable by nature. Each OTP is valid for a single transaction and then expires, eliminating the need for long-term key management in IoT devices. This approach reduces device complexity and security vulnerability while maintaining transaction security, as each authorization credential is used once and discarded.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

2Reliability

If specialized cryptographic hardware is used for transaction signing, then security is improved, but development cost and processing cost increase

Engineering Contradiction:

Improveauthorization securityVSAvoiddevelopment cost

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The patent makes the authorization system universal by allowing any device with OTP capability (smartphones, hardware tokens, or even simple IoT devices) to participate in transaction authorization. The system does not require specialized cryptographic hardware in every IoT device, as the OTP generation and verification can be performed using general-purpose devices. This reduces development cost while maintaining security through the cryptographic strength of the OTP mechanism.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Ease of operation

If private keys are stored on general-purpose smartphones, then ease of operation is improved, but security risk increases

Engineering Contradiction:

Improveuser convenienceVSAvoidkey compromise risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent uses one-time passwords that are short-lived and disposable, generated on general-purpose smartphones for ease of operation. Each OTP is valid for only one transaction and then expires, which dramatically reduces the security risk of key compromise. Even if a smartphone is compromised, the attacker can only use the OTP for a single transaction before it expires, unlike permanent private keys that would remain vulnerable indefinitely.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

4Reliability

If asymmetric cryptography is used for transaction signing, then cryptographic integrity is improved, but processing cost and power consumption increase

Engineering Contradiction:

Improvecryptographic integrityVSAvoidpower consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent applies partial asymmetric cryptography only where necessary for security (in the OTP generation and verification process), rather than requiring full asymmetric cryptographic operations in every IoT device for every transaction. The OTP mechanism provides cryptographic integrity through controlled use of asymmetric cryptography during the authorization phase, while the actual transaction execution can proceed with lighter computational requirements, thus reducing power consumption while maintaining integrity.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11138608B2Authorizing multiparty blockchain transactions via one-time passwords

Publication Date: 2021.10.05 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An example operation may include one or more of creating a proposed transaction including one or more assets, transmitting the proposed transaction to a user device for authorization, receiving authorization from the user device via an asynchronous one-time password to authorize the proposed transaction, and creating a blockchain transaction including the asynchronous one-time password and content of the proposed transaction responsive to receiving the authorization.