One-Time Password Authentication for Default Accounts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Default accounts on devices, especially those programmed at manufacture, are insecure due to widely known generic credentials, making them vulnerable to unauthorized access, particularly in IoT systems and servers.
Innovation Solution
A method and system that generates and authenticates a one-time password using a remote device's public and private keys corresponding to the device and account, ensuring secure access to default accounts without storing the password on either device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If generic default credentials are used for device accounts, then ease of operation is improved, but security is worsened
Solution Approach 1:
The system pre-generates device-specific credentials during manufacturing and stores them on a remote server. When a user needs to access the default account, the credentials are automatically provided through the server without requiring the user to manually configure security settings. This preliminary preparation resolves the contradiction by making security configuration as easy as generic credentials while maintaining unique device identification.
Solution Approach 2:
A remote server acts as an intermediary between the device and the user for credential management. The server stores device-specific credentials and provides them to users on demand, eliminating the need for users to directly handle complex security configurations. This intermediary approach maintains security through device-specific credentials while preserving ease of operation through automated credential distribution.
2Reliability
If device-specific unique passwords are generated for each device, then security is improved, but device complexity is worsened
Solution Approach 1:
The credential management functionality is extracted from the device itself and placed on a remote server. The device only needs to communicate with the server to obtain credentials, rather than implementing its own complex credential generation and management system. This extraction maintains security through device-specific credentials while minimizing device complexity by offloading the management burden to the server.
Solution Approach 2:
The remote server provides a universal credential management service that can serve multiple devices with different security requirements. The same server infrastructure handles credential distribution for various device types, making the security system scalable without increasing individual device complexity. Each device benefits from device-specific credentials through a standardized server interface.
Data Source
AI summary
One embodiment provides a method, including: receiving, at a remote device and from a user, a request to generate a one-time password for accessing a default account of a device, wherein the remote device comprises a device public key corresponding to the device and an account public/private key pair corresponding to the default account; generating, at the remote device, the one-time password utilizing the account private key and the device public key; and providing, from the remote device, the one-time password to the user. Other aspects are described and claimed.