Single-Use Password Authentication for Session Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for client systems interacting with server systems are vulnerable to malicious impersonation, as cookies used for session authentication can be intercepted and reused by unauthorized parties, leading to potential theft of sensitive information.
Innovation Solution
Implement a system where the client system performs an initial authentication with the server, receiving a cryptographic key, and subsequently generates and provides a single-use password (SUP) for each access request, which is verified by the server to ensure continuous authentication and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cookies are used for session authentication, then ease of operation is improved, but security deteriorates due to interception and reuse by unauthorized parties
Solution Approach 1:
The patent implements single-use passwords (SUPs) that are valid for only one authentication request and then become invalid. Each SUP is generated using a cryptographic key and attributes, and after use, it cannot be reused. This disposable approach prevents unauthorized parties from intercepting and reusing authentication credentials, directly addressing the security vulnerability of traditional cookies while maintaining ease of operation.
2Reliability
If single-use passwords are generated and verified for each access request, then security is improved, but device complexity increases
Solution Approach 1:
The client system automatically generates single-use passwords using its stored cryptographic key and attributes without requiring manual intervention. The SUP generation process is automated and integrated into the authentication flow, reducing the perceived complexity for users while maintaining strong security. The system serves itself by managing the cryptographic operations and SUP lifecycle automatically.
Solution Approach 2:
The cryptographic key is established during an initial authentication phase before actual access requests are made. This preliminary setup allows subsequent SUP generation to be straightforward and efficient, as the foundational cryptographic material is already in place. The preliminary action of key establishment simplifies the complexity of repeated authentication operations.
3Reliability
If cryptographic keys and attributes are used for SUP generation, then security against impersonation is improved, but loss of time increases due to repeated re-authentication
Solution Approach 1:
Instead of transmitting the actual cryptographic key and attributes with each authentication request, the system generates a SUP that is a cryptographic copy or derivation of these secrets. The SUP can be independently verified by the server without requiring the original key material to be transmitted or re-processed, significantly reducing authentication time while maintaining strong impersonation protection.
Data Source
AI summary
Techniques are disclosed relating to authenticating a client computer system to a server computer system. In some embodiments, a client computer system sends, to a server computer system, authentication information for an initial access request for one or more resources. This information may include authentication credentials and attributes that collectively identify the client computer system. In some embodiments, the client computer system receives, from the server computer system, an authentication response that indicates an initial authentication of the client computer system. In some embodiments, the authentication response includes a cryptographic key. While the initial authentication is valid, in some embodiments, the client computer system repeatedly re-authenticates for subsequent access requests. Each of the subsequent access request may include a single-use password generated using a cryptographic key and the attributes of the client computer system.