OTP Client Software Dynamic Secret Synthesis for Brute-Force Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OTP solutions for mobile platforms are vulnerable to unauthorized access and brute-force attacks, as the shared secret is often stored on the device, making them susceptible to viruses and hacking.
Innovation Solution
The shared secret for OTP generation is dynamically synthesized based on a PIN, with no knowledge of the correct PIN stored on the client device, ensuring that OTP generation occurs without storing the PIN on the user's mobile device, and validation is done on the server side, limiting failed login attempts and preventing offline brute-force attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the shared secret is stored on the mobile device for OTP generation, then OTP generation can be performed locally, but the device becomes vulnerable to unauthorized access and brute-force attacks
Solution Approach 1:
The patent extracts the shared secret from the mobile device and stores it only on the server. The mobile device performs OTP generation using a different mechanism (hashing the entered PIN with a server-stored secret), eliminating the security vulnerability of storing the shared secret on the device while maintaining local OTP generation capability.
Solution Approach 2:
The patent introduces an intermediary validation process where the server validates the OTP against multiple possible PINs. The server acts as a mediator that resolves the conflict between allowing local OTP generation and preventing unauthorized access by performing secure validation without exposing the shared secret.
2Productivity
If the PIN and shared secret are stored on the client device, then OTP generation is convenient, but offline brute-force attacks become feasible
Solution Approach 1:
The patent extracts both the PIN and shared secret from the client device, storing only the shared secret on the server. The client device generates OTPs by hashing entered PINs locally, but the actual validation occurs on the server, preventing offline brute-force attacks while maintaining fast OTP generation.
Solution Approach 2:
The patent performs preliminary setup by storing the shared secret on the server during account creation. This preliminary action ensures that the critical security data is never stored on the client device, preventing future offline attacks while allowing rapid OTP generation through local hashing operations.
3Adaptability or versatility
If unlimited failed login attempts are allowed, then user flexibility is maintained, but account security is compromised
Solution Approach 1:
The patent implements preliminary account locking after a threshold of failed validation attempts. This preliminary action prevents brute-force attacks by blocking further attempts before they can succeed, while maintaining user flexibility through legitimate multi-PIN support for forgotten PIN scenarios.
Solution Approach 2:
The patent implements feedback through account locking mechanisms that respond to failed validation attempts. The system monitors attempt patterns and provides feedback by locking accounts when abuse is detected, while allowing legitimate users to recover through supported PIN variations, thus balancing security and flexibility.
Data Source
AI summary
Secure user authentication using an OTP involve pre-storing an OTP application on a first computing device for generating a valid OTP value for the user responsive to receiving entry of a valid PIN value of the user, no part of the valid PIN value is stored on the first computing device and pre-storing on a back-end server the valid PIN value and a valid shared secret for the user. Upon receiving entry of a purported PIN value, a purported shared secret is dynamically synthesized by the OTP application based on the purported PIN value of the user and a purported OTP value is generated. Upon receiving entry of the purported OTP value in a login attempt on the back-end server from another device, the server cryptographically calculates a window of OTP values, and login is allowed if the calculated window of OTP values corresponds to the received OTP value.