Pre-generated One-Time Password Lists for Client Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password (OTP) systems face challenges such as requiring non-trivial processing, reliance on local storage which can be lost or corrupted, and vulnerability to cryptographic attacks, necessitating improved methods for OTP generation and storage.
Innovation Solution
A system that generates and stores a large list of pre-generated OTPs on a client device, utilizing recent advancements in data storage capacity, allowing for secure initialization and modification, even without built-in protected storage, and enabling the client device to select OTPs based on a counter or time without needing to generate them locally.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTPs are generated and stored locally on the client device, then authentication security is improved, but device complexity and processing requirements increase
Solution Approach 1:
The OTP generation function is extracted from the client device and relocated to a centralized server. The server generates and stores OTP lists, then delivers them to clients upon request. This extraction eliminates the need for complex local OTP generation algorithms on client devices while maintaining security through centralized control and true random number generation on the server side.
2Reliability
If cryptographic algorithms are used for OTP generation, then authentication capability is improved, but vulnerability to cryptanalysis increases
Solution Approach 1:
The system uses disposable, pre-generated OTP lists that are delivered to clients and then consumed. Each OTP list contains multiple one-time passwords that are used sequentially or selected based on counter/time values. Once used, the OTPs are discarded. This approach eliminates the need for ongoing cryptographic generation and storage of secret keys, reducing vulnerability to cryptanalysis while maintaining strong authentication capability.
3Ease of operation
If OTP lists are pre-generated and stored on the server, then client processing requirements are reduced, but server storage and network bandwidth requirements increase
Solution Approach 1:
OTP lists are pre-generated and stored on the server before being requested by clients. This preliminary action allows the server to prepare authentication credentials in advance, enabling fast and simple client-side authentication. The pre-generated lists can be efficiently stored using compressed formats and delivered to clients in bulk, reducing per-authentication network overhead.
4Reliability
If OTP lists are delivered to client devices, then local storage capability is improved, but risk of loss or corruption increases
Solution Approach 1:
The system enables continuous replenishment of OTP lists on client devices. When the server detects that a client's OTP list is depleted or expiring, it automatically generates new lists and delivers them. This continuous action ensures that clients always have valid OTPs available locally without manual intervention, maintaining local storage capability while mitigating the risk of information loss through automatic renewal.
Data Source
AI summary
Embodiments of the invention provide systems and methods for the storage of One-Time Passwords (OTPs) on a device (principal) that needs to authenticate from time to time. It utilizes recent availability of data storage capacity not previously exploited in this arena. Also disclosed is the means to initialize and modify the system (all principals) in a secure manner, and the means to store the OTP production means on a device in a secure manner, even if the device has no built-in protected storage.