One Time Password Algorithm for Interoperable Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication methods are limited in scope and scale due to lack of interoperability among hardware and software vendors, relying on expensive, single-function devices, and static passwords are inadequate for securing network access against increasing threats.
Innovation Solution
A sequence-based One Time Password (OTP) algorithm that can be implemented in various devices such as Java smart cards, USB dongles, and GSM SIM cards, using the HMAC-SHA-1 algorithm for secure authentication, allowing for flexible, interoperable authentication across multiple devices and applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proprietary hardware and software components are tightly coupled, then authentication security is maintained, but device complexity and cost increase while interoperability decreases
Solution Approach 1:
The authentication system is divided into separate hardware token and software agent components that can independently operate. The token generates OTPs using local algorithms while the software agent validates them, eliminating the need for tight coupling between proprietary hardware and software while maintaining security through distributed authentication logic.
Solution Approach 2:
The authentication token is designed to work with multiple software agents across different platforms and applications through standardized protocols. The token can authenticate users to various services including email, instant messaging, and web applications without requiring proprietary integration, achieving universal compatibility while maintaining strong authentication.
2Reliability
If expensive single-function devices are used for two-factor authentication, then authentication security is improved, but device cost and complexity increase
Solution Approach 1:
The authentication token is designed as a multi-functional device that can generate OTPs for various authentication protocols and work with different software agents. It supports multiple authentication methods including time-based and event-based OTP generation, making it suitable for diverse applications from email protection to VPN access without requiring multiple specialized devices.
Solution Approach 2:
The token operates autonomously using local algorithms and stored secrets to generate OTPs without requiring constant communication with external servers. The device maintains its own counter or time synchronization and can independently produce authentication codes, reducing dependency on complex infrastructure while maintaining security.
3Ease of operation
If static passwords are used for network authentication, then ease of operation is maintained, but security against network threats deteriorates
Solution Approach 1:
The authentication system transitions from static passwords to dynamic one-time passwords that change with each authentication event. The OTPs are generated based on evolving secrets including time counters or event-based triggers, ensuring that each authentication code is unique and cannot be reused, thereby providing dynamic security while maintaining user convenience through automated generation.
4Reliability
If client desktop software is installed on user machines for strong authentication, then authentication security is improved, but ease of operation and device portability decrease
Solution Approach 1:
The authentication functionality is extracted from the user's personal computer and relocated to a portable token device. The token contains the necessary cryptographic secrets and algorithms to generate OTPs independently, eliminating the need for installing authentication software on each user machine. Users simply carry the token and enter the displayed OTP, achieving strong authentication without compromising portability.
Data Source
AI summary
A token calculates a one time password by generating a HMAC-SHA-1 value based upon a key K and a counter value C, truncating the generated HMAC-SHA-1 value modulo 10^Digit, where Digit is the number of digits in the one time password. The one time password can be validated by a validation server that calculates its own version of the password using K and its own counter value C′. If there is an initial mismatch, the validation server compensate for a lack of synchronization between counters C and C′ within a look-ahead window, whose size can be set by a parameter s.