Smart Key Device Secure Password Entry via Dynamic Random Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for protecting hardware passwords are ineffective when the source code of upper software is compromised, leading to potential loss of private keys during network interactions, especially with smart key devices.
Innovation Solution
A method and system for securely inputting passwords, where a user participates in a dynamic secret code verification process, and the input password is not displayed on the screen, involving a smart key device and an upper computer that generates and displays random characters for user input, with verification responses processed using hash algorithms to ensure secure authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password protection methods are used with smart key devices, then the hardware password can be protected through encryption, but the password may still be lost if the upper software source code is falsified or compromised
Solution Approach 1:
The patent extracts the secret code verification process from the upper software environment and relocates it to the smart key device hardware. The random character generation and verification logic are implemented in the hardware device itself, removing the vulnerability to software source code compromise. Only the verification result (not the secret code) is transmitted back to the upper computer, ensuring that even if the upper software is compromised, the attacker cannot obtain the actual password or secret code.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where the smart key device acts as a trusted mediator between the user and the upper computer. The device generates random secret codes, presents them to the user for verification, and returns only the verification result without exposing the actual secret code. This intermediary process prevents direct exposure of sensitive information to potentially compromised software environments.
2Ease of operation
If the password is displayed on the upper computer screen for user input, then the user can easily input the password, but the password may be exposed to unauthorized viewing or screen capture
Solution Approach 1:
The patent extracts the secret code display function from the upper computer screen and relocates it to the smart key device display. The random characters are generated and displayed on the device itself, not on the potentially compromised upper computer screen. This prevents screen capture attacks and unauthorized viewing through the upper computer's display system.
Solution Approach 2:
Instead of displaying the password on the upper computer and having the user type it in (traditional approach), the patent inverts the process by displaying random characters on the smart key device and having the user verify them. The verification result is then transmitted back, reversing the traditional password input flow to eliminate exposure risks.
3Ease of operation
If the same password verification process is used repeatedly, then the user experience is consistent, but the security risk increases due to potential pattern recognition or brute force attacks
Solution Approach 1:
The patent implements dynamic random character generation for each verification attempt. Instead of using static passwords or predictable patterns, the system generates new random secret codes dynamically for each verification process. This ensures that even if multiple verification attempts are made, each one uses a different secret code, preventing pattern recognition and making brute force attacks ineffective.
Solution Approach 2:
The patent changes the parameter of the secret code itself by generating new random characters for each verification attempt. This parameter change ensures that the verification process remains consistent in structure but varies in content, providing both user experience consistency and security against repeated attacks. The random character set and arrangement are regenerated each time, preventing any predictable patterns.
Data Source
AI summary
A method and system for safely entering a password, the method comprising: a smart key device receives a password verification request sent from an upper computer, generates and displays randomly arranged characters, and returns a password verification response to the upper computer; upon the reception of the password verification response, the upper computer displays a password input interface and waits for a user to input, upon the reception of a user input, obtains a password acquisition response according to the user input, and sends the password acquisition response to the smart key device; and the smart key device determines whether the user input is correct according to the received password acquisition response. By means of the present invention, a password input solution in which a user needs to click a different position every time a password character is entered is achieved. In addition, the numbers are not displayed on the screen of the upper computer, the security of the user's digital assets is further ensured.