Password Segmentation via Mobile Intermediary for Secure Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing multiple user account credentials securely is challenging, leading to reduced security practices such as reused or easily guessable passwords, and vulnerabilities when devices are compromised.
Innovation Solution
An authentication method that uses a password server to generate a password divided into an initial and remaining portion, where the initial portion is sent to a mobile device and the remaining portion to a password client, combining them for authentication, ensuring the complete password is never transmitted, and using a mobile communication device for secure input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a person uses multiple username/password combinations for different accounts, then access to multiple network resources is enabled, but the security of protected information is reduced
Solution Approach 1:
The password is segmented into two distinct parts: a static PIN portion that the user memorizes and a dynamic fresh portion that is regularly updated and delivered via mobile device. This segmentation allows the user to maintain security without memorizing multiple complete passwords, as only the static PIN needs to be remembered while the dynamic portion changes frequently.
Solution Approach 2:
A mobile communication device serves as an intermediary between the password management system and the user. It delivers the fresh portion of the password to the user without exposing the complete password, thereby enhancing security while enabling access to multiple accounts. The mobile device acts as a secure channel that prevents exposure of full credentials.
2Ease of operation
If easy-to-remember passwords are chosen, then ease of operation is improved, but security is reduced due to ease of guessing
Solution Approach 1:
The password is divided into a memorable static PIN portion and a non-memorable dynamic fresh portion delivered via mobile device. The user only needs to remember the simple PIN, while the complex fresh portion is provided externally, combining ease of operation with strong security.
Solution Approach 2:
The fresh portion of the password is prepared and delivered to the user's mobile device in advance of when it is needed for authentication. This allows the user to have secure, complex passwords available without needing to memorize them, as the system proactively provides the necessary credentials.
3Ease of operation
If username/password combinations are written down in unencrypted files, then ease of operation is improved, but security is compromised
Solution Approach 1:
The mobile communication device serves as a secure intermediary that delivers password portions without requiring physical storage of credentials. Users receive the fresh portion electronically through a secure channel, eliminating the need to write down passwords in unencrypted files while maintaining easy access.
Solution Approach 2:
Instead of storing complete passwords physically, the system creates and distributes digital copies of the fresh password portion through secure electronic communication. This replaces physical written credentials with secure digital delivery, maintaining accessibility while improving security.
4Ease of operation
If the complete password is transmitted for authentication, then authentication process is simplified, but vulnerability to eavesdropping increases
Solution Approach 1:
The password is segmented and transmitted in separate parts through different channels: the static PIN is stored securely on the server while the dynamic fresh portion is delivered via mobile device. During authentication, only the fresh portion needs to be transmitted, reducing the risk associated with transmitting complete credentials.
Solution Approach 2:
The password system transitions from static complete password transmission to dynamic partial password transmission. The fresh portion changes regularly and is delivered through a secure mobile channel, making eavesdropped information obsolete quickly and reducing the window of vulnerability.
Data Source
Figure 1-1~1-3
Figure 2-1~2-3
Figure 3
AI summary
An authentication scheme may be used to decide whether to permit access to a user account (306,316,326,912) access to which is controlled by a network resource server (304,314,324,900). An initial portion (602) of a password is received at a mobile communication device (302,800), and a remaining portion (604,606) of the password is received at a password client (340) installed in or otherwise coupled to the network resource server. The initial portion is communicated from the mobile communication device to the network resource server, where it is passed to the password client, which combines it and the remaining portion to produce a complete password. A value calculated by the password client from the complete password is sent to a password server (330,1000), which generated the password and sent the initial portion and remaining portion. If the value matches a value calculated by the password server from the complete password in the same manner, authentication has succeeded.