Segmented Authentication Modules Using Shared Secrets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems, particularly for remote access, face challenges in verifying the identity and possession of a device, as they are vulnerable to unauthorized access and compromise, allowing fraudsters to use stolen credentials and OTPs to access sensitive data.
Innovation Solution
A system comprising two communicatively disconnected modules, where one module generates and the other validates a password using a shared secret, ensuring that only the legitimate user in possession of both modules can access the data, with additional security measures like secure elements and time-dependent passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTP tokens and authentication servers are used to verify user identity, then authentication security is improved, but the system becomes vulnerable to compromise and unauthorized distribution of OTP generation keys
Solution Approach 1:
The system divides the authentication process into two separate modules: a first module that generates passwords using a shared secret, and a second module that validates those passwords. This segmentation ensures that even if one module is compromised, the other remains secure, preventing unauthorized distribution of authentication credentials.
Solution Approach 2:
The patent introduces an intermediary verification process where the second module acts as a mediator between the user and the authentication system. The second module validates passwords without having direct access to the shared secret, creating a secure intermediary layer that prevents direct compromise of the authentication mechanism.
2Ease of operation
If centralized authentication servers store OTP generation keys, then user verification is simplified, but the risk of system-wide compromise increases
Solution Approach 1:
The authentication system is segmented into distributed first and second modules, each holding only a portion of the authentication capability. The first module generates passwords locally using the shared secret, while the second module validates them independently, eliminating the need for a centralized server that stores all authentication credentials.
Solution Approach 2:
The first module performs self-service authentication by generating passwords locally using the shared secret without needing to query a centralized server. This self-service capability reduces dependency on centralized infrastructure while maintaining security, as each module independently verifies authentication credentials.
3Ease of operation
If communication channels between modules are established for verification, then authentication functionality is enabled, but the risk of interception and unauthorized access increases
Solution Approach 1:
The patent extracts the shared secret from any communication channel between modules. The first module generates passwords using the shared secret locally, and only the resulting password (not the secret itself) is transmitted for validation. This extraction of the sensitive element from the communication path eliminates interception risks.
Solution Approach 2:
The system uses disposable, time-limited passwords generated by the first module and validated by the second module. Each password is valid for a single authentication attempt and then discarded, preventing replay attacks and making intercepted credentials useless for future unauthorized access.
4Ease of operation
If traditional credential verification is used, then user identification is straightforward, but the system cannot verify physical possession of the device
Solution Approach 1:
The authentication system is divided into two physical modules that must both be present for successful authentication. The first module generates passwords based on the shared secret, while the second module validates them. This segmentation ensures that possession of both modules is required, providing precise verification of physical possession rather than just knowledge of credentials.
Data Source
AI summary
A system for verifying a request for access to data is provided, the system comprising a first module 20 and a second module 30. The first module 20 is arranged to generate a password, and the second module 30 is arranged to receive a password associated with a request for data, validate the received password, and enable access to the requested data. The system is such that the first and second modules 20, 30 share a secret that has been uniquely assigned thereto, the shared secret being for use in generation and validation of a said password. Furthermore, the first module 20 is communicatively disconnected from the second module 30.