One-Time Passcode Verification with Device Identity Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time-passcode (OTP) verification systems are vulnerable to unauthorized access due to the inability to verify the identity of the device generating the OTP, allowing malware to export the security seed to another device, compromising security.
Innovation Solution
A system that includes a client trust module on the client device to collect device attributes and pair them with a user ID, a trust broker to create a device ID, and an OTP generation module to generate and transmit OTPs along with the device ID to an authentication server for verification, ensuring the device's identity is tied to the authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTP generation is implemented without device verification, then authentication security is improved through strong rotating passcodes, but device identity verification is lost allowing malware to export seeds to unauthorized devices
Solution Approach 1:
The patent introduces a trust broker as an intermediary component that mediates between the OTP generation module and the authentication server. The trust broker verifies device identity through collected attributes (device ID, hardware identifiers, software version) before allowing OTP generation, thus preventing malware from exporting seeds to unauthorized devices while maintaining the security benefits of rotating passcodes
Solution Approach 2:
The system performs preliminary device verification and attribute collection before OTP generation occurs. The trust broker collects and validates device attributes in advance, creating a trusted device profile that is verified prior to allowing the OTP module to generate passcodes, ensuring only authorized devices can generate valid OTPs
2Reliability
If hardware based tokens are used to verify device identity, then unauthorized device access is prevented, but system complexity and user burden increase
Solution Approach 1:
Instead of requiring physical hardware tokens, the patent creates a software-based trust profile that copies the essential verification functionality. The trust broker collects device attributes and creates a digital representation of device identity that can be verified programmatically, eliminating the need for cumbersome hardware tokens while maintaining security
Solution Approach 2:
The patent replaces the mechanical/physical hardware token system with a software-based verification mechanism. The trust broker uses software to collect, store, and verify device attributes, substituting the physical hardware token with a digital trust profile that achieves the same security objective without the complexity of hardware management
3Reliability
If device attributes are collected and verified, then unauthorized OTP usage is prevented, but authentication process time increases
Solution Approach 1:
The trust broker collects and verifies device attributes in advance during device onboarding, creating a pre-validated trust profile. When authentication is needed, the system only needs to verify against the pre-created profile rather than collecting and analyzing all attributes in real-time, significantly reducing authentication latency
Solution Approach 2:
The system implements dynamic verification where the depth of attribute verification can be adjusted based on context. For trusted devices with established profiles, verification is faster and can use simplified checks, while new or suspicious devices undergo more comprehensive verification, optimizing the balance between security and speed
Data Source
AI summary
Generally, this disclosure provides systems, devices, methods and computer readable media for secure user authentication with improved OTP verification. The device may include an attribute collection module configured to collect attributes associated with the device; a client trust module configured to identify a user of the device, associate a user ID with the user and transmit the user ID and the collected attributes to a trust broker system; the client trust module further configured to receive a device ID from the trust broker system, the device ID associated with a pairing of the user ID and the attributes; and a client OTP generation module configured to generate an OTP and further configured to transmit the OTP and the device ID to an authentication server.