Partial One-Time Password Authentication Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password (OTP) authentication schemes are susceptible to harvesting attacks, such as man-in-the-middle and keylogger attacks, where attackers can collect a large sample of OTPs to predict subsequent valid OTPs, compromising security.
Innovation Solution
Generating a partial one-time password (OTP) by applying masking criteria to select a subset of characters from the entire OTP, making it difficult for attackers to guess the underlying information or determine the selection criteria, thereby enhancing security without affecting user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full one-time password (OTP) is used for authentication, then the authentication process is simple and user-friendly, but the system becomes vulnerable to harvesting attacks where attackers can collect and predict subsequent OTPs
Solution Approach 1:
The patent applies segmentation by dividing the full OTP into a partial OTP that contains only a subset of characters. The system generates a full OTP but then selects only specific characters (e.g., every second character) to create the partial OTP used for authentication. This segmentation reduces the information available to attackers while maintaining the authentication function, thereby improving security against harvesting attacks without significantly complicating the user experience.
2Reliability
If masking criteria are applied to select a subset of characters from the OTP, then security against predicting subsequent OTPs is enhanced, but the complexity of generating and verifying the partial OTP increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing and storing the masking criteria (selection pattern) in the system before authentication occurs. The masking criteria define which characters from the full OTP should be selected (e.g., positions 1, 3, 5... or every second character). By preparing this selection pattern in advance and storing it for later use, the system avoids complex real-time calculations during authentication, thus enhancing security while minimizing operational complexity.
3Ease of operation
If the entire OTP is provided to the user, then the user experience is simple and straightforward, but attackers can collect complete OTP samples to predict future OTPs
Solution Approach 1:
The patent applies the extraction principle by taking only the necessary subset of characters from the full OTP to create the partial OTP. Instead of providing the complete OTP to the user, the system extracts and provides only the selected characters (e.g., every second character) that are sufficient for authentication. This extraction reduces the amount of information exposed to attackers during man-in-the-middle attacks while maintaining the ease of use for legitimate users, as the partial OTP remains a simple authentication code.
Data Source
AI summary
Techniques are disclosed relating to authenticating a user based on a partial password. In one embodiment, a computer system stores masking criteria defining how a mask is to be applied to generated passwords. In some embodiments, the computer system receives a request from a user to generate a one-time password. In response to the request, in some embodiments, the computer system generates the one-time password having a sequence of characters, applies the mask to the generated one-time password to select a subset of the sequence of characters usable to authenticate the user, and presents the selected subset of characters to the user as a partial password for authentication.