OTP Authentication Cryptogram Using User PIN Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing OTP authentication processes are susceptible to security risks due to static encryption data being stored on cards, making them vulnerable to network exposure and data breaches, which can be exploited by hackers to generate and validate OTP cryptograms.
Innovation Solution
Incorporating user-provided secret data, such as a PIN, into the OTP authentication process by using a challenge signing instruction to prompt for a user response, which is combined with a card-stored secret value to generate a modified Message Authentication Code (MAC), and encrypting this with unique session keys to create a two-factor authentication cryptogram.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static encryption data is stored on OTP cards to enable authentication, then authentication functionality is achieved, but security is compromised due to vulnerability to data breaches and network exposure
Solution Approach 1:
The authentication system is segmented into two distinct parts: static encryption data stored on the OTP card and dynamic user-provided secret (such as PIN) entered at runtime. This segmentation ensures that compromising one part (the card data) does not automatically compromise the entire authentication system, as both components are required together for successful authentication.
Solution Approach 2:
The static encryption data is prepared and stored on the OTP card in advance during card personalization, while the user-provided secret is collected at the moment of authentication. This preliminary preparation of card data combined with real-time user input creates a layered security approach where past compromises of card data alone become insufficient.
2Object-affected harmful factors
If user-provided secret data is incorporated into the authentication process, then security is enhanced through two-factor authentication, but system complexity increases
Solution Approach 1:
The system merges two independent authentication factors: the static encryption data on the OTP card and the dynamic user-provided secret. By combining these two elements through cryptographic operations (such as HMAC computation), the system achieves enhanced security without requiring completely separate authentication mechanisms, thus managing complexity through integration rather than multiplication of systems.
Solution Approach 2:
A cryptographic intermediary process is introduced that takes both the static card data and dynamic user input, processes them together through a hash function or MAC algorithm, and produces the authentication token. This intermediary computational layer securely binds the two factors together without requiring direct physical or organizational complexity.
3Object-affected harmful factors
If dynamic user input is required for authentication, then unauthorized access is prevented even with compromised card data, but authentication time and user interaction increase
Solution Approach 1:
The system requires only a partial user input (such as a PIN or passphrase) rather than full biometric verification or multiple sequential challenges. This partial action approach provides sufficient security enhancement while minimizing the time and interaction burden on users, balancing security needs with user convenience.
Data Source
AI summary
The disclosed system and method is directed to improving operational security associated with One-Time Password (OTP) authentication card. The proposed solution involves incorporating a user-provided data value, such as a Personal Identification Number (PIN) and/or a password, into the cryptographic process flow for the generation of the Message Authentication Code (MAC) associated with a OTP authentication cryptogram. A key operational aspect corresponds to the scrambling of a unique card-stored data such as a shared secret value, with run-time data externally provided by the user. In this way, the proposed system and method incorporates two factors of identification, associated with card-stored and user-known data elements, into an OTP card authentication cryptogram.