Security Device Authentication Seed Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing authentication methods face challenges in providing the security of hardware tokens while maintaining the convenience of software tokens, particularly in provisioning seeds and resisting malicious attacks.

Innovation Solution

A security device communicates with a software token construct on a user device via a connector, encrypting and decrypting a provisioned seed, where the encryption key is stored inaccessibly within the security device, ensuring secure storage and generation of token codes without exposing the seed to the user device.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a hardware token is used to provide security, then authentication security is improved, but provisioning convenience deteriorates

Engineering Contradiction:

Improveauthentication securityVSAvoidprovisioning convenience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

A security device acts as an intermediary between the user device and the authentication server. The security device receives the seed from the authentication server, encrypts it using a key stored in an inaccessible memory location, and returns the encrypted seed to the user device. This intermediary approach allows the user device to store the seed without exposing it to malware, while maintaining the convenience of software token provisioning.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The encryption key is extracted from the user device and stored in an inaccessible memory location within the security device. This separation ensures that even if the user device is compromised by malware, the seed remains protected. The key is taken out of the vulnerable environment (user device) and placed in a secure environment (security device with inaccessible memory).

Inventive Principle:

Principle #2Taking out (Extraction)

2Ease of operation

If a software token is used to improve provisioning ease, then provisioning convenience is improved, but authentication security deteriorates

Engineering Contradiction:

Improveprovisioning convenienceVSAvoidauthentication security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The security device serves as a mediator that receives the seed from the authentication server and encrypts it before returning it to the user device. This intermediary encryption mechanism allows the user device to store the seed conveniently without compromising security, as the seed is encrypted and cannot be accessed by malware on the user device.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The seed is taken out of the vulnerable software environment on the user device and encrypted before storage. The encryption key is extracted from the user device and stored in an inaccessible memory location, ensuring that the seed cannot be accessed by malware while maintaining ease of provisioning through the security device interface.

Inventive Principle:

Principle #2Taking out (Extraction)

3Ease of operation

If the seed is stored in accessible memory on the user device, then ease of access is improved, but vulnerability to malicious attacks increases

Engineering Contradiction:

Improveseed accessibilityVSAvoidvulnerability to malware attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The seed is extracted from the vulnerable accessible memory on the user device and encrypted before storage. The encryption key is taken out of the user device and stored in an inaccessible memory location within the security device. This ensures that even if malware gains access to the user device, it cannot read the seed, while the user can still conveniently access the seed through the security device interface when needed.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The security device acts as an intermediary that provides a secure interface between the user and the encrypted seed. The user can conveniently access the seed through the security device without directly accessing the encrypted storage on the user device. This intermediary approach maintains ease of operation while protecting against malware attacks on the user device.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9130753B1Authentication using security device with electronic interface

Publication Date: 2015.09.08 RSA SECURITY USA LLC

AI summary

An authentication technique employs a security device that communicates with a software token construct installed on a user device via a connector. The technique includes secure provisioning of an authentication seed and safe storage of the seed in encrypted form on the user device. A key for decrypting the seed is stored within the security device, and token codes are generated by physically connecting the security device to the user device and conveying the encrypted seed from the user device to the security device over the connector.