Shared Secret Seed Updates for One-Time Passcode Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems based on shared secret values, such as passwords or symmetric keys, fail to ensure that only the intended client and server share the secret, leading to vulnerabilities like Man-in-the-Middle attacks and unauthorized access, as the secrecy of the shared secret cannot be reliably verified over time.
Innovation Solution
A method where the server updates the shared secret seed after successful authentication using the one-time passcode and timestamp, creating a chain of shared secret seeds, allowing detection of inconsistencies and anomalies, such as unauthorized access attempts, by comparing new passcodes with previously accepted ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a shared secret seed is used for authentication, then authentication efficiency is improved, but the risk of unauthorized access increases because multiple clients can share the same secret
Solution Approach 1:
The patent applies dynamics by making the shared secret seed changeable over time. Instead of using a static shared secret, the system dynamically updates the seed after each authentication event, creating a time-evolving secret that cannot be reused by unauthorized clients.
Solution Approach 2:
The patent changes the parameter of the shared secret itself by updating it with new random values after each authentication. This parameter change ensures that even if an attacker compromises one secret value, they cannot use it for future authentications since the secret has already changed.
2Reliability
If the shared secret seed is updated frequently, then security against unauthorized access is improved, but the complexity of the authentication system increases
Solution Approach 1:
The system uses feedback by having the server communicate the updated seed back to the client after each authentication. This feedback mechanism ensures both parties stay synchronized without requiring complex key distribution infrastructure, as the update is naturally propagated through the existing authentication channel.
Solution Approach 2:
The authentication system performs self-service by automatically generating and distributing updated seeds through the normal authentication flow. No separate key management system or manual intervention is needed - the seed updates are handled autonomously as part of the authentication process itself.
3Ease of operation
If the shared secret seed has a long valid lifetime, then ease of operation is improved, but the window for unauthorized access increases
Solution Approach 1:
The patent applies discarding by automatically invalidating old seed values after they are superseded by new ones. The system discards compromised or expired secrets and recovers authentication capability through new seed generation, ensuring that stolen or leaked secrets cannot be used beyond their valid lifetime.
Data Source
AI summary
Techniques are provided for authenticating a user using shared secret seed updates for one-time passcode (OTP) generation. One method comprises, in response to a first authentication of a client using a given OTP derived from a given shared secret seed, updating, by a server, the given shared secret seed using the given OTP and/or a timestamp from the first authentication to generate an updated given shared secret seed; and evaluating a second authentication using a new OTP derived from the updated given shared secret seed. An anomaly may be detected when the client attempts the second authentication using an OTP and the server determines that the OTP was generated by a previously used shared secret seed. The server may store a set of previously accepted OTPs, and evaluate the previously accepted OTPs to validate the new OTP.