One-Time Password Tokens Without Seed Exposure in Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional one-time password (OTP) systems are vulnerable to theft of the seed material, making them expensive and limiting reuse or resale of hardware tokens, and they are not suitable for multi-tenant shared resource environments.
Innovation Solution
Pre-generate a set of verification codes valid for a predetermined time interval, encode them, and store them in a data structure like a bloom filter, providing these codes to verification systems without the seed value, allowing tokens to be leased and reused across different verification systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional OTP systems use seed material stored in verification systems, then OTP generation is enabled, but security is compromised due to seed theft vulnerability
Solution Approach 1:
The patent extracts the seed material from the verification system and stores it only in the token device. The verification system receives only the generated OTP codes without possessing the seed, thereby eliminating the security vulnerability of seed theft from the verification system while maintaining OTP generation capability.
Solution Approach 2:
The patent pre-generates multiple OTP codes in the token device using the stored seed material before the verification system needs them. This preliminary generation allows the verification system to receive ready-to-use OTP codes without needing to store or process the seed material, achieving both security and functionality.
2Reliability
If hardware tokens are made secure against seed theft, then security is improved, but token cost increases and reuse becomes limited
Solution Approach 1:
By extracting the seed material storage function exclusively to the token device and removing it from the verification system, the patent reduces the security requirements and associated costs for the verification system. The token becomes a self-contained secure unit that can be reused across multiple verification systems without requiring expensive security infrastructure at each verification point.
Solution Approach 2:
The patent makes the token device universal by enabling it to generate OTP codes that can be verified by any verification system that implements the matching verification logic. The token contains all necessary security elements (seed material) and can serve multiple verification systems, increasing token reuse potential and reducing per-system costs.
3Ease of operation
If verification systems store seed material for OTP generation, then OTP verification is enabled, but adaptability to multi-tenant environments is reduced
Solution Approach 1:
The patent extracts the seed material from the verification system, allowing the verification system to be lightweight and adaptable to different tenants. Each verification system instance can operate independently with its own OTP verification logic without needing to store sensitive seed material, enabling easy deployment in multi-tenant cloud environments where isolation and adaptability are crucial.
Solution Approach 2:
Instead of storing seed material that would need to be securely copied or shared across multiple tenants, the patent uses the token device as a portable copy of the security credentials. The verification system only needs to store and compare OTP codes, which can be easily replicated across multiple tenants without security risks, enabling scalable multi-tenant deployment.
Data Source
AI summary
A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.