Randomizing One-Time Token State Transitions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional time-based one-time authentication tokens are vulnerable to state-inference attacks as attackers can optimize their success probability by scheduling attacks at the beginning of the passcode generation epoch due to predictable state transitions.

Innovation Solution

Implementing a randomized mechanism for internal state transitions by decoupling passcode generation and presentation times, using a uniformly distributed random offset for computation completion, and varying the number of passcodes generated per epoch, while maintaining a regular passcode appearance schedule to prevent attackers from anticipating state transitions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If time-based tokens use predetermined, fixed time intervals for state transitions, then the system is simple and predictable, but attackers can optimize their success probability by scheduling attacks at the beginning of the passcode generation epoch

Engineering Contradiction:

Improvestate transition mechanismVSAvoidsecurity against inference attacks

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent applies dynamics by transforming the static, fixed time interval state transitions into dynamic, randomized transitions. The system introduces random offsets and variable durations for state transitions, making the transition timing unpredictable to attackers while maintaining simplicity in the overall system architecture. This resolves the contradiction by making the system adaptive rather than rigid.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes the temporal parameters of state transitions from fixed values to random variables. Specifically, it uses uniformly distributed random offsets within epochs and variable durations for computation and presentation, thereby altering the timing parameters to prevent predictable attack scheduling while keeping the mechanism relatively simple.

Inventive Principle:

Principle #35Parameter changes

2Ease of operation

If the passcode generation computation is completed at a fixed time before presentation, then the timing is predictable and easy to control, but the system becomes vulnerable to state-inference attacks

Engineering Contradiction:

Improvepasscode generation controlVSAvoidstate-inference attack vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system makes the computation completion time dynamic by introducing random offsets and variable computation durations. The computation no longer completes at a fixed time but at a randomized time within the epoch, making it difficult for attackers to predict when state transitions occur and thereby reducing vulnerability to state-inference attacks.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent applies preliminary action by performing computation and state transitions in advance but at randomized times. The system pre-computes passcodes with randomized timing offsets, so that while the computation is completed before presentation, the exact timing is unpredictable, preventing attackers from optimizing their attack windows.

Inventive Principle:

Principle #10Preliminary action

3Device complexity

If the number of passcodes generated per epoch is fixed, then the system is simple and predictable, but attackers can optimize attack timing based on this predictability

Engineering Contradiction:

Improvepasscode generation scheduleVSAvoidsecurity against optimized attacks

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent transforms the fixed number of passcodes per epoch into a variable number by introducing randomization. The system dynamically determines how many passcodes are generated in each epoch based on random variables, making the generation schedule unpredictable while maintaining operational simplicity. This prevents attackers from optimizing their attacks based on predictable patterns.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS10129249B1Randomizing state transitions for one-time authentication tokens

Publication Date: 2018.11.13 EMC IP HLDG CO LLC

AI summary

Methods and apparatus are provided for randomizing state transitions for one-time authentication tokens. A user authentication passcode is generated by determining a generation time within an epoch for initiating computation of the user authentication passcode; initiating computation of the user authentication passcode at the determined generation time; and presenting the user authentication passcode at a presentation time that is de-coupled from the generation time. The generation time occurs, for example, at a random offset from a start of the epoch. A time difference between the presentation time and a completion of the computation of the user authentication passcode comprises, e.g., a uniformly distributed random variable over a range of values having a finite mean value. The epoch optionally comprises pre-computation epochs and a variable number of user authentication passcodes are optionally computed during a given pre-computation epoch. The number of passcodes generated per epoch can be varied in a random manner.