Security Server One-Time Password Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user and transaction authentication methods are vulnerable to attacks and cumbersome, with single sign-on techniques exacerbating issues, and transaction authentication is crucial to prevent post-login attacks, while existing solutions like out-of-band authentication are inconvenient and costly for frequent use.
Innovation Solution
A network-based security server calculates a one-time-password based on shared secrets between the server and the website, transmitting it to a pop-up window or alternative device for user confirmation, eliminating the need for user-shared secrets and enabling transaction authentication without compromising usability or cost efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, smart cards) are used, then user authentication can be achieved, but they are vulnerable to MITM and MITB attacks
Solution Approach 1:
The patent introduces a security server as an intermediary component that mediates between the user and the website. This security server generates one-time passwords and transaction signatures, acting as a trusted third party that eliminates the need for users to directly manage secrets or credentials, thereby preventing MITM and MITB attacks while maintaining authentication reliability
Solution Approach 2:
The patent creates a virtual copy of the security server's functionality within the user's browser through a pop-up window interface. This allows the security server to present transaction information and obtain user confirmation without requiring separate hardware devices, maintaining security while improving ease of use
2Ease of operation
If single sign-on techniques (OpenID, FaceBook Connect) are used, then login convenience is improved, but security worsens as attackers can break into all accounts relying on the compromised master account
Solution Approach 1:
The patent segments the authentication process into distinct components: the security server that generates one-time credentials, the pop-up window that presents transaction information, and the website that verifies signatures. This segmentation allows each component to perform its specific function securely, enabling convenient single sign-on while preventing cascading account compromises through transaction-level authentication
3Reliability
If out-of-band authentication (voice calls, text messages) is used, then transaction authentication security is improved, but usability and cost worsen due to inconvenience and expense for frequent use
Solution Approach 1:
The patent creates a universal authentication mechanism that works across multiple devices and platforms through the browser-based pop-up window. The security server can communicate with any device that has a web browser, eliminating the need for device-specific out-of-band authentication methods while maintaining transaction authentication security
Solution Approach 2:
The patent replaces the mechanical system of out-of-band authentication (phone calls, text messages requiring separate devices) with an electronic/software-based system that uses the existing browser environment. This substitution eliminates the need for additional hardware or communication channels while providing the same transaction verification functionality
Data Source
Figure 1
Figure 2
Figure 3
AI summary
To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website, directly from the network site. The security server calculates a one-time- password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user's signature on the transaction. The one-time- password is independently calculable by the network site based on the shared secret.