Password Manager for Legacy Authentication 2FA Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems that rely on one-factor authentication, such as static passwords, are vulnerable to attacks like phishing and pharming, and implementing two-factor authentication (2FA) is often hindered by cost, system compatibility, and the need for significant upgrades or modifications, especially in legacy systems like Kerberos-based systems.
Innovation Solution
A system and method that transform existing one-factor authentication systems into 2FA by using a token manager to generate dynamic codes and a password manager to replace static passwords with new authentication codes formed by combining static and dynamic passwords, without requiring modifications to the existing system, through operations like 'Change Password' or 'Set/Reset Password', allowing for secure access based on both factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two-factor authentication is implemented using commercial solutions (RSA, VASCO, DS3), then security is improved, but system complexity and deployment cost increase significantly
Solution Approach 1:
The patent introduces an intermediary component called the Password Manager that acts as a mediator between the existing authentication system and the 2FA token. This Password Manager transparently handles the dynamic password generation and integration, allowing legacy systems to benefit from 2FA without requiring complex modifications to their core authentication logic or protocol stacks.
Solution Approach 2:
The system enables self-service by allowing the Password Manager to automatically generate, manage, and rotate dynamic passwords without requiring manual configuration or intervention in the legacy authentication system. The token and Password Manager work autonomously to provide 2FA protection while the existing system continues to operate unchanged.
2Reliability
If two-factor authentication is integrated into existing systems, then security is improved, but deployment and maintenance difficulty increase
Solution Approach 1:
The patent segments the 2FA implementation into independent, modular components: the authentication token and the Password Manager. This segmentation allows the 2FA functionality to be deployed as a separate layer that interfaces with the existing authentication system without requiring integration into the core system architecture, thereby simplifying deployment and maintenance.
Solution Approach 2:
The Password Manager is designed as a universal component that can interface with multiple different legacy authentication systems and protocols. It provides multi-functional capability by handling various authentication methods (Kerberos, NTLM, etc.) through a single implementation, making deployment across diverse systems easier and more maintainable.
3Adaptability or versatility
If Kerberos protocol is used for authentication, then system compatibility is improved, but two-factor authentication compatibility deteriorates
Solution Approach 1:
The Password Manager serves as an intermediary layer between the Kerberos protocol and the 2FA token. It translates and adapts the authentication flows, allowing the Kerberos-based legacy system to work with the dynamic password from the token without requiring modifications to the Kerberos protocol itself, thereby maintaining system compatibility while enabling 2FA.
4Ease of manufacture
If legacy applications are maintained without modification, then system feasibility is improved, but security protection deteriorates
Solution Approach 1:
The patent implements a nested architecture where the 2FA Password Manager and token functionality are nested around the existing legacy authentication system. The outer layer (Password Manager) provides enhanced security through 2FA, while the inner layer (legacy system) remains unchanged and operational. This nesting allows security protection to be added without modifying the core legacy application.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention provides systems and processes for transforming any system that implements a static password authentication or 1st-factor authentication so as to enforce strong 2-factor authentication, requiring the user to present both a static password and a dynamic password, without having to modify the existing system.