One-Time Password Generation Using Secure Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online security techniques are vulnerable to attacks such as keystroke logging, phishing, and man-in-the-middle schemes, which compromise user credentials and allow unauthorized access to services.
Innovation Solution
A system utilizing one-time-passwords (OTPs) generated by both user devices and verification servers using shared algorithms, with secure processors like TPMs to ensure randomness and protection, providing an additional layer of security against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional username and password authentication is used, then ease of operation is improved, but security is worsened due to vulnerability to keystroke logging, phishing, and man-in-the-middle attacks
Solution Approach 1:
The authentication credentials are segmented into two parts: a static shared secret stored securely in the remote device and a dynamic one-time password generated by the verification server. This segmentation allows the static part to remain protected while the dynamic part provides changing authentication values that cannot be reused, thereby maintaining ease of operation while significantly improving security against replay attacks, phishing, and keystroke logging.
Solution Approach 2:
The verification server preliminarily generates and stores multiple one-time passwords in association with the user's account before the user needs to authenticate. When the user requests authentication, the server provides the next expected one-time password from this pre-generated set. This preliminary action ensures that even if an attacker intercepts or logs the authentication process, they cannot reuse the one-time password because it has already been consumed and invalidated.
2Reliability
If one-time-passwords are generated using shared algorithms and secure processors, then security is improved, but device complexity is worsened
Solution Approach 1:
A verification server acts as an intermediary between the user's remote device and the service provider. The server handles the complex cryptographic operations for generating and managing one-time passwords, while the remote device only needs to securely store a shared secret and communicate with the server. This intermediary approach distributes the computational complexity to a centralized secure server, reducing the burden on individual client devices while maintaining high security standards.
Solution Approach 2:
The verification server automatically generates, manages, and validates one-time passwords without requiring manual intervention or complex client-side cryptographic implementations. The server maintains the shared secrets securely and autonomously generates the next expected one-time password for each authentication attempt, comparing it with what the user provides. This self-service mechanism simplifies the client device requirements while ensuring security through automated, consistent cryptographic operations.
Data Source
AI summary
A secure processor such as a TPM generates one-time-passwords used to authenticate a communication device to a service provider. In some embodiments the TPM maintains one-time-password data and performs the one-time-password algorithm within a secure boundary associated with the TPM. In some embodiments the TPM generates one-time-password data structures and associated parent keys and manages the parent keys in the same manner it manages standard TPM keys.