One-Time Password Generation via Challenge-Response Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods, such as one-time passwords (OTPs), are vulnerable to security incidents when user terminals are stolen, lost, or compromised by malicious codes or viruses, as they can generate OTPs without permission.
Innovation Solution
A method and apparatus that generate an OTP only after authenticating user secret information through a user verification apparatus, using a response value based on the user secret information and a challenge value, ensuring the OTP is issued only to authenticated users, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OTP is generated by user terminal without authentication, then ease of operation is improved, but security deteriorates
Solution Approach 1:
The system performs preliminary authentication of user secret information before allowing OTP generation. The user secret information is authenticated by generating a response value based on the secret information and a challenge value, and verifying this response value against stored verification data. This preliminary authentication ensures that only authenticated users can generate OTPs, preventing unauthorized OTP generation even if the terminal is compromised.
2Device complexity
If OTP is generated using only challenge value and response value, then device complexity is reduced, but security deteriorates
Solution Approach 1:
The OTP is generated by combining multiple authenticated secret information elements: the user secret information, the challenge value, and the response value. This merging of multiple authenticated components creates a more secure OTP that cannot be generated without possessing all the authenticated secret information, thereby enhancing security while maintaining reasonable system complexity.
3Loss of information
If user terminal is stolen or lost, then loss of information occurs, but unauthorized OTP generation becomes possible
Solution Approach 1:
The system implements feedback mechanisms where the user verification apparatus stores verification data (verification-purpose password, challenge value, response value) and uses this stored information to verify the effectiveness of generated OTPs. This feedback loop ensures that even if a terminal is stolen, unauthorized OTPs generated without the authenticated secret information will fail verification, preventing unauthorized access.
Data Source
AI summary
Disclosed is a technology related to a method of generating an OTP and an apparatus for performing the same. The method includes receiving user secret information that is input according to execution of a process of providing an OTP; authenticating the user secret information by generating a response value based on the received user secret information and a challenge value received from a user verification apparatus, and transmitting the response value to the user verification apparatus; and generating an OTP using at least one of the user secret information, the challenge value and the response value as the user secret information is authenticated, thereby effectively dealing with loss or appropriation of a user terminal and also improving the security of an OTP.