Session-Specific Authentication Data Transformation for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems are vulnerable to eavesdropping and man-in-the-middle attacks, as knowledge factors can be easily compromised, and possession factors can be stolen or replicated, lacking sufficient security to restrict access to authorized devices and locations while maintaining user convenience.
Innovation Solution
A distributed processing system that uses session-specific authentication factors to transform and verify authentication data, incorporating context information such as geographic location and device identifiers, allowing authentication only when the user is at an authorized location and using an approved device, without requiring a secret keyword.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If knowledge factors (passwords, PINs) are used for authentication, then user convenience is maintained, but security is compromised due to susceptibility to eavesdropping and man-in-the-middle attacks
Solution Approach 1:
The patent extracts the secret keyword from the authentication process entirely. Instead of requiring users to input passwords or PINs, the system uses a pre-shared secret keyword that is never transmitted or entered by the user. The authentication data is transformed using this keyword on the server side, eliminating the vulnerability of transmitting or entering secrets during authentication.
Solution Approach 2:
The patent introduces session-specific authentication factors as intermediaries between the user and the authentication system. These factors (device identifiers, location data, time stamps) act as mediators that provide security without requiring direct user input of secrets. The transformation algorithm uses these intermediaries to create unique authentication challenges for each session.
2Reliability
If possession factors (tokens, cards) are used for authentication, then security is improved, but the system becomes vulnerable to theft and replication
Solution Approach 1:
The patent implements dynamic authentication where the authentication data changes with each session based on session-specific factors. Instead of using static possession factors like tokens or cards that can be stolen and replicated, the system generates unique authentication challenges for each session using device identifiers, location data, and time stamps. This makes stolen or replicated credentials useless for future authentication attempts.
Solution Approach 2:
The patent changes the parameters of authentication from static possession factors to dynamic session-specific factors. The authentication data is transformed using session-specific authentication factors including device identifiers, geographic location, and time stamps. This parameter change ensures that even if authentication data is intercepted, it cannot be reused because the transformation parameters are unique to each session.
3Reliability
If additional security factors are implemented to restrict access to authorized locations and devices, then authentication security is enhanced, but system complexity increases
Solution Approach 1:
The patent implements a universal transformation algorithm that handles multiple authentication factors (device identifiers, location data, time stamps) in a single integrated process. The server-side transformation algorithm universally processes all session-specific factors through one function, rather than requiring separate verification steps for each factor. This multi-functionality reduces system complexity while maintaining enhanced security.
Solution Approach 2:
The patent implements self-service authentication where the user's device automatically provides session-specific authentication factors without requiring user configuration or input. The device automatically transmits its identifier, location data, and time stamp information to the server. The server automatically transforms the authentication data using these factors, eliminating the need for complex user setup procedures while maintaining security.
4Device complexity
If traditional authentication methods are used, then system simplicity is maintained, but protection against eavesdropping attacks is insufficient
Solution Approach 1:
The patent implements preliminary action by pre-sharing secret keywords between the server and authorized devices before authentication begins. These keywords are never transmitted during the authentication process. Instead, the server uses the pre-shared keyword to transform authentication data on the server side, eliminating the need to transmit secrets during authentication and thus protecting against eavesdropping while maintaining system simplicity.
Data Source
AI summary
A user authentication method in a distributed processing system commences by receiving, at a first processing unit (108), a request (1004) to initiate an authentication session, wherein the request includes a unique identifier of a user requiring authentication. The first processing unit acquires at least one item of authentication data (412, 1712), which is valid during the authentication session. The authentication data is transmitted (1006) to a second processing unit (106) which is associated with a terminal device operated by the user. The second processing unit transforms the authentication data using a transformation algorithm based upon one or more session-specific authentication factors (404, 1704), to generate transformed authentication data that is characteristic of the authentication session and of the user. The transformed authentication data is transmitted (1008) to a third processing unit (108) which verifies that the transformed authentication data corresponds with the user and with predetermined values of the one or more session-specific authentication factors. The third processing unit generates an authentication result (1010) of the authentication session based upon the verification.