Soft Token Copy Detection via Device-Specific Random Bits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems using soft tokens on mobile devices are vulnerable to unauthorized copying, as they cannot distinguish between token codes generated by authorized users and attackers, allowing malicious users to potentially gain access to remote networks.
Innovation Solution
A method is implemented where a set of random bits is generated on the mobile device and provided to a server during authentication requests, allowing the server to learn and predict these bits over multiple login attempts, enabling detection of unauthorized soft token copies by matching received samples against predicted values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If soft tokens are copied from one mobile device to another, then users can access remote networks on multiple devices, but unauthorized attackers can use stolen seed records to generate token codes and gain unauthorized access
Solution Approach 1:
The authentication system is segmented into multiple independent components: the seed record stored on the server, the soft token application on the mobile device, and the newly introduced random bits specific to each device. This segmentation allows the system to distinguish between authorized copies (which would have matching random bits) and unauthorized attacks (which would have different random bits), resolving the security vulnerability while maintaining multi-device access capability
Solution Approach 2:
Random bits are introduced as an intermediary element that bridges the server and the mobile device. These random bits serve as a unique identifier for each device-seed combination, allowing the server to verify whether a token code originates from an authorized device. This intermediary mechanism enables the server to distinguish between legitimate soft token copies and unauthorized attacks without compromising the multi-device access functionality
2Ease of operation
If the server accepts token codes from multiple devices with the same seed, then legitimate users can access from multiple devices, but the server cannot distinguish between legitimate users and attackers using stolen seeds
Solution Approach 1:
The system applies local quality by making each device-seed combination unique through the introduction of device-specific random bits. While the seed itself remains the same across multiple authorized devices, the random bits vary by device, creating a locally unique identifier for each authentication instance. This allows the server to easily distinguish between legitimate multi-device access and unauthorized attacks without complicating the authentication process
3Productivity
If attackers try multiple seeds from a stolen seed record, then they may eventually succeed in gaining access, but each attempt increases the probability of detection by the server
Solution Approach 1:
The server performs preliminary action by pre-generating and storing the expected random bits for each authorized device-seed combination before any authentication attempt occurs. When a token code is received, the server can immediately verify it against the pre-computed expected value, enabling instant detection of unauthorized attacks. This preliminary preparation eliminates the need for complex real-time analysis and ensures high detection probability for any attacker attempting to use stolen seeds
Data Source
AI summary
A technique for detecting unauthorized copies of a soft token that runs on a mobile device includes generating a set of random bits on the mobile device and providing samples of the set of random bits, as well as token codes from the soft token, for delivery to a server during authentication requests. The server acquires the set of random bits of the mobile device, or learns the set of random bits over the course of multiple login attempts. Thereafter, the server predicts values of the samples of the set of random bits and tests actual samples arriving in connection with subsequent authentication requests. Mismatches between predicted samples and received samples indicate discrepancies between the random bits of the device providing the samples and the random bits of the mobile device, and thus indicate unauthorized soft token copies.