Short-Range Authentication Tokens for Offline Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multifactor authentication systems in both physical and virtual scenarios often require computationally expensive network communications and cryptographic operations, which can be inefficient and vulnerable to attacks.
Innovation Solution
A short-range communication-based authentication system using a smart card with an integrated circuit that generates a cryptographic token through offline token generation, leveraging secure short-range communications to verify user identity and permissions, utilizing cryptographic hashes and time-locked keys to create a bearer token that can authenticate users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network-based authentication systems are used, then authentication can be performed with centralized control, but computational overhead and network communication requirements increase significantly
Solution Approach 1:
The authentication system is segmented into two parts: a smart card that performs local cryptographic operations and a remote system that verifies tokens. The smart card contains cryptographic keys and performs token generation offline, while the remote system only needs to verify tokens when the user presents them. This segmentation moves computational overhead from the remote system to the smart card, reducing network communication requirements and energy consumption at the remote endpoint.
Solution Approach 2:
The smart card pre-generates authentication tokens offline using stored cryptographic keys before the user needs to authenticate. These tokens are prepared in advance and can be quickly presented to the remote system for verification. This preliminary action eliminates the need for computationally expensive real-time cryptographic operations over the network, reducing both computational overhead and energy consumption during the actual authentication event.
2Reliability
If traditional authentication systems are used, then centralized authentication control is maintained, but vulnerability to network attacks increases
Solution Approach 1:
By segmenting the authentication process into offline token generation at the smart card and online verification at the remote system, the system reduces the attack surface. The smart card operates independently with stored cryptographic keys, so compromise of the remote system does not directly expose keys. Network communication is minimized to token verification only, reducing exposure to network-based attacks while maintaining centralized control through the verification process.
Solution Approach 2:
The smart card acts as an intermediary that holds cryptographic keys securely and generates tokens locally. This intermediary prevents direct exposure of private keys over the network, as the card never transmits its private key—only verified tokens. This intermediary layer protects against network attacks while maintaining the ability to centrally issue and verify authentication credentials.
3Productivity
If offline token generation is implemented, then computational overhead is reduced, but device complexity increases due to integrated circuit requirements
Solution Approach 1:
The patent merges multiple functions into a single smart card integrated circuit: secure key storage, random number generation, cryptographic token generation, and time-stamping capabilities. By combining these functions into one device, the system achieves offline authentication capability without proportionally increasing overall system complexity. The smart card becomes a self-contained authentication module that can be integrated into existing card readers and access control systems with minimal additional complexity.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This system enhances security and efficiency by enabling secure, offline authentication with reduced computational overhead, preventing unauthorized access and reducing the risk of attacks.
Implementation Method 1
utilizing, by the integrated circuit of the short range wireless card, a time keeping circuit to generate a first time value associated with a current time; wherein the first time value is representative of a window of time starting at the current time
Implementation Method 2
utilizing, by the integrated circuit of the short range wireless card, at least one first cryptographic hash to produce a bearer token including at least one first hashed value based at least in part on: the identifier, the device ID, the first time value and the first cryptographic key
Implementation Method 3
transmitting, by the integrated circuit of the short range wireless card and via a return short range wireless signal, to the user device, the bearer token
Data Source
AI summary
Systems and methods of the present disclosure enable improved cryptographic security using an integrated circuit of a short range wireless card. The integrated circuit receives, via a short range wireless signal, from a user device, a bearer token request including an identifier that identifies a user, the user device or both. The integrated circuit determines a cryptographic key and uses a time keeping circuit to generate a time value indicative of a window of time for which a bearer token is to be valid. The integrated circuit uses a cryptographic hash to produce the bearer token based on: the identifier, the time value and the cryptographic key. The integrated circuit transmits, via a return short range wireless signal to the user device, the bearer token to enable authentication of the user upon the bearer token being equivalent to a comparison token within the time window.