PIN-Token Authentication for Secure Multi-Device Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for accessing application features on user devices using user identifiers and passwords are not optimal, as they require full authentication for each device, which can be cumbersome and insecure.
Innovation Solution
A system and method that registers users with a server using a user identifier and password, allowing access to applications on user devices via a short PIN, which generates and manages tokens for secure, device-specific access without storing the PIN on the device or server, enabling secure access to application functions without full authentication for valid tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users authenticate with user identifier and password on each device, then security is maintained, but ease of operation deteriorates due to cumbersome full authentication
Solution Approach 1:
The authentication system is segmented into two parts: a long-lived token stored on the device and a short-lived PIN code. The token provides persistent identification while the PIN provides temporary authentication, allowing users to access applications without repeatedly entering full credentials. This segmentation resolves the contradiction by making daily access simple (using PIN) while maintaining security through the token-PIN combination.
Solution Approach 2:
The system performs preliminary authentication by issuing a long-lived token to the device after initial user verification. This token is stored on the device and used for subsequent authentication sessions, eliminating the need for repeated full authentication. The preliminary action of token issuance enables faster, more convenient access while maintaining security through the token-PIN verification process.
2Ease of operation
If PIN is stored on user device, then ease of operation improves, but security deteriorates due to potential PIN exposure
Solution Approach 1:
The system introduces an intermediary verification process where the server acts as a mediator between the device and the authentication validation. Instead of storing the PIN on the device or comparing it directly, the server receives the PIN, verifies it against the encrypted hash stored on the server, and validates the token-PIN combination. This intermediary process eliminates the need to store sensitive PIN data on the device while maintaining ease of operation.
3Productivity
If full authentication is required for each access, then security is maintained, but productivity deteriorates due to repeated authentication steps
Solution Approach 1:
The authentication system transitions from a static full authentication process to a dynamic multi-phase process. Initially, users undergo complete authentication with user identifier and password to obtain a long-lived token. For subsequent accesses, the system dynamically uses the stored token combined with a shorter PIN verification. This dynamic approach improves productivity by reducing authentication steps while maintaining security through the token-PIN verification mechanism.
Data Source
AI summary
A system and method allows a user to register one or more PINs on one or more user devices, and then authenticates the user to a server via the PIN and a token deposited on the user device being used by the user to allow access to an application on the user device. Individual tokens, or all tokens deposited on the user devices for a user account, may be invalidated, and the user is prevented from authenticating himself or herself via a PIN to allow access to an application on any device for which the last token deposited was invalidated, until the same or different PIN is registered for that device.