Session Re-authentication Using Variable Tokencodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security token-based authentication techniques provide insufficient security against malware and hacking, as they only authenticate users once at the beginning of a session, leaving them vulnerable to session hijacking and other malicious activities.
Innovation Solution
Implementing a method that requires users to authenticate multiple times during a session using variable authentication information, such as a changing tokencode from a security token, to establish and re-establish a secure channel, thereby enhancing security without modifying existing applications or communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If one-time authentication at the beginning of a session is used, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent implements periodic re-authentication during a session by requiring users to periodically present updated tokencodes generated by their security tokens. This periodic action maintains security without requiring modification of applications or communication protocols, resolving the contradiction between ease of operation and security.
2Reliability
If multiple authentications during a session are implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent achieves multiple authentications during a session by reusing existing security token infrastructure and protocols. The same security token that provides initial authentication continues to provide periodic tokencodes for re-authentication, making the system multi-functional without adding device complexity.
3Reliability
If variable authentication information is used for re-authentication, then security is improved, but loss of time is worsened
Solution Approach 1:
Security tokens continuously generate tokencodes in advance based on time-synchronous or event-based algorithms. During re-authentication, the user simply presents the current tokencode without performing additional computational actions, minimizing time loss while maintaining security through variable authentication information.
Data Source
AI summary
Access of a user to a protected resource during a session is controlled by issuing an authentication information request and receiving authentication information from the user responsive to the authentication information request. The user is authenticated based upon verification of the received authentication information. One or more of the issuing, receiving and authenticating steps are repeated during the session to re-authenticate the user. At least a portion of the authentication information that is used during the re-authentication is different from a corresponding portion of the authentication information that was used during the initial authentication. A secure channel is optionally established between the user and the protected resource responsive to the initial verification. The secure channel can optionally be re-established with the re-authentication using the different portion of the authentication information.