Secure Login Using Device-Specific Hash Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network service login systems fail to securely alleviate user annoyance from repeated manual entry of credentials while preserving security, as existing methods are either insecure or vulnerable to attacks.
Innovation Solution
A secure login system that generates a hash token on the server using device identifiers and a salt value, allowing subsequent authentication requests without re-entering credentials, while ensuring the token is tied to the original device and unusable from unauthorized devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are saved on the subscriber device (in plain text or encrypted form), then user convenience is improved by avoiding repeated manual entry, but security deteriorates as credentials become vulnerable to retrieval and reuse attacks
Solution Approach 1:
The patent extracts the authentication mechanism from traditional credential storage by implementing a challenge-response system where the server generates challenges and the device responds with cryptographic proofs. This removes the need to store credentials on the device while maintaining authentication capability, thus improving security without sacrificing convenience.
Solution Approach 2:
The patent introduces cryptographic intermediaries (challenge-response protocols, zero-knowledge proofs) that mediate between the user's credentials and the authentication process. These intermediaries allow verification of credentials without exposing or storing them on the device, resolving the contradiction between convenience and security.
2Reliability
If temporary authentication tokens are used that are generated by a server and valid for a short period, then security is improved by limiting token validity time, but vulnerability to theft and reuse attacks persists
Solution Approach 1:
The patent implements dynamic authentication where challenge-response pairs are generated fresh for each authentication attempt. The authentication tokens are not static but dynamically created based on server-generated challenges, making them useless if intercepted. This dynamic approach eliminates the vulnerability to theft and reuse while maintaining security.
3Ease of operation
If simpler forms of identification are requested from users, then ease of operation is improved, but security deteriorates as these systems are easily compromised by those with physical access
Solution Approach 1:
The patent implements self-service authentication where the device itself generates and manages cryptographic credentials locally without requiring users to input or manage complex authentication data. The device performs self-authentication using stored cryptographic material, providing both ease of operation and security against physical access since the credentials never leave the device.
Data Source
AI summary
A network service may receive an authentication request from a subscriber device, the authentication request including a user credential and a device identifier of the subscriber device. The service may validate the authentication request based at least in part on the included user credential, and when the authentication request is validated, provide an authentication reply to the subscriber device indicative of allowance of the subscriber device to access the service, the authentication reply including a hash token keyed to the device identifier of the subscriber device for use in validation of subsequent authentication requests. The service may further generate a second hash token based on the device identifier of a subsequent authentication request; validate a subsequent authentication request according to the hash token and the second hash token; and when the subsequent authentication request is validated, allowing the subscriber device to access the service.