Second Factor Authentication Using Shared Key and Image Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security is compromised due to the ease with which logins and passwords can be guessed, and existing second-factor authentication methods, such as codes, are challenging for users and not sufficiently secure.
Innovation Solution
A system and method that uses a shared electronic key to compute a one-time PIN on a mobile device, which is then used to verify the user's presence by drawing a random image, eliminating the need for manual code transfer and enhancing security through a push-based second-factor authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional login and password methods are used, then ease of operation is improved, but network security deteriorates due to ease of guessing
Solution Approach 1:
The authentication process is segmented into multiple independent factors: knowledge-based (password), possession-based (mobile device with key), and behavior-based (drawing pattern). This segmentation ensures that compromising one factor does not compromise overall security, while each factor remains individually simple to interact with.
Solution Approach 2:
A shared electronic key acts as an intermediary between the server and mobile device, enabling secure authentication without requiring the user to manually transfer codes. The key facilitates automated verification of the drawing pattern while maintaining security through cryptographic validation.
2Reliability
If manual code transfer is used for second-factor authentication, then security is improved, but ease of operation deteriorates due to user complexity
Solution Approach 1:
The mobile device automatically generates and submits the one-time PIN using the shared electronic key without requiring manual user intervention to transfer codes. The system performs the authentication code generation and transmission autonomously, reducing user burden while maintaining security through automated verification of the drawing pattern.
Solution Approach 2:
The manual mechanical process of copying and pasting codes is replaced with an automated electronic system where the mobile device electronically generates and transmits the one-time PIN. This substitution eliminates manual transfer steps while maintaining security through cryptographic validation of the drawing pattern.
3Ease of operation
If push-based second-factor authentication is implemented, then ease of operation is improved, but security may deteriorate due to potential attacks
Solution Approach 1:
The authentication system uses asymmetric verification where the server validates the drawing pattern against the expected pattern generated from the shared key. The complexity of verification remains on the server side while the user side remains simple, creating an asymmetric balance between ease of operation and security.
Solution Approach 2:
The shared electronic key is pre-established between the server and mobile device before authentication occurs. This preliminary key exchange enables secure automated verification of the drawing pattern without requiring manual code transfer, thereby maintaining both simplicity and security against attacks.
Data Source
AI summary
At an authorization server, a shared secret electronic key may be shared with a second computer. A selection to use a system to complete a transaction may be received from a first computing device. An image may be communicated to the first computing device. A digital representation entered by the user representing the image and a PIN based on the copy of the shared electronic key may be received from the second computing device. The system and method may determine if the digital representation entered by the user on the second computing device matches the image communicated to the first computing device. The system and method may determine if the PIN based on the copy of the shared electronic key from the second computing device is as expected. In response to determining the digital representation entered by the user matches the image and the PIN the second computing device is as expected, the user may be authorized.