Security Server 2CHK Authentication Protocol
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods, such as passwords and one-time passwords, are vulnerable to attacks and cumbersome, while single sign-on techniques can lead to compromised accounts, and out-of-band authentication is costly and inconvenient for frequent transactions.
Innovation Solution
The 2CHK system and protocol provide secure login and transaction authentication using a security server that establishes a secure communication channel with users through alternative contact methods, generating one-time passwords without requiring a per-user shared secret, and can be implemented on desktop and mobile devices with adjunct hardware for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, OTPs, smartcards) are used, then user authentication can be achieved, but the system becomes vulnerable to attacks and requires cumbersome security management
Solution Approach 1:
The patent introduces a security server as an intermediary between the user and the website. The security server generates OTPs based on a shared secret with the website and delivers them to the user through alternate communication channels. This mediator resolves the contradiction by providing strong authentication (matching website and user) through the security server without requiring the user to directly manage complex security credentials.
Solution Approach 2:
The patent extracts the shared secret from the user's direct possession and stores it only on the security server and the website. The user receives only the generated OTP through alternate channels, not the secret itself. This extraction eliminates the need for users to manage complex security credentials while maintaining strong authentication, resolving the contradiction between security and convenience.
2Reliability
If out-of-band authentication is used for transaction confirmation, then transaction security is improved, but the process becomes too costly and inconvenient for frequent transactions
Solution Approach 1:
The patent makes the security server a universal authentication authority that serves multiple websites and handles both login authentication and transaction confirmation. Instead of requiring separate out-of-band verification for each transaction, the security server provides OTP-based authentication that works across multiple transactions and websites, reducing both cost and inconvenience while maintaining security.
Solution Approach 2:
The patent enables continuous authentication through the security server for multiple transactions without requiring repeated out-of-band verification steps. Once the security server is established, it continuously provides OTPs for authentication and transaction confirmation, eliminating the need for intermittent, costly out-of-band verification for each transaction.
3Ease of operation
If single sign-on techniques (OpenID, Facebook Connect) are used, then login convenience is improved, but security worsens as compromising one master account allows access to all other accounts
Solution Approach 1:
The patent segments the authentication system so that each website has its own independent shared secret with the security server, rather than relying on a single master account credential. The security server generates site-specific OTPs for each website, isolating security breaches to individual websites rather than compromising all accounts through a single master credential.
4Reliability
If per-user shared secrets are used in OTP systems, then authentication security is improved, but system complexity and cost increase
Solution Approach 1:
The patent merges the shared secret storage into a single centralized location (the security server) rather than distributing secrets to every user and website. The security server generates OTPs using the shared secret and delivers them to users, eliminating the need for complex key management infrastructure while maintaining strong authentication. This consolidation reduces system complexity and cost.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of operating a security server to securely transact business between a user and an enterprise via a network includes receiving, at the security server from an enterprise with which the user is currently connected via the network, a request of the enterprise to activate a secure communications channel over the network between the user and the security server. The request includes contact information for contacting the user via other than the network. The security server, in response, transmits an activation code for delivery to the user via other than the network and in a manner corresponding to the received contact information. The security server receives, from the user via the network, an activation code and compares the received activation code with the transmitted activation code to validate the received activation code. The secure communications channel is then activated based on the validation of the received activation code.