Soft Token Seed Binding via Device ID Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current soft token solutions for two-factor authentication are limited by their inability to persistently bind tokens to user devices, expose token seeds during generation, lack compatibility with various devices and platforms, and fail to provide out-of-band authentication, leading to security vulnerabilities in online transactions and VPN access.
Innovation Solution
A soft token system that uses a mobile device's unique device ID to encrypt and bind a token seed, allowing for secure generation of One Time Passwords (OTPs) across multiple platforms, with out-of-band authentication through activation codes and secure seed delivery via encrypted channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a soft token solution binds a token to a user device only at the time of importing the token seed, then the token can be generated and used, but the binding does not persist thereafter, allowing the token to be copied or transferred to other devices
Solution Approach 1:
The system performs preliminary binding of the token seed to the user device at the time of import, establishing a persistent association before the token is put into service. This preliminary action ensures that the token cannot be copied or transferred to other devices, as the binding is established in advance and maintained throughout the token's lifecycle.
Solution Approach 2:
The system introduces a server as an intermediary component that manages the binding between tokens and user devices. The server stores binding information and verifies it during token operations, enabling persistent binding without requiring complex local mechanisms on the user device. This intermediary approach simplifies the overall system while achieving reliable token binding.
2Adaptability or versatility
If the token seed is generated on an external server, then the token can be distributed to users, but the token seed is exposed during the generation and transmission process
Solution Approach 1:
The system extracts the critical security function of token seed generation and storage from the external server and places it on the user device. The server only distributes encrypted tokens, while the actual seed material is generated and stored locally on the user device, eliminating the exposure risk associated with server-based seed generation and transmission.
Solution Approach 2:
Instead of transmitting the actual token seed through the network, the system transmits an encrypted copy of the token that can only be decrypted on the user device. This copying approach allows token distribution while preventing seed exposure, as the encrypted token cannot be used without the local decryption key.
3Reliability
If manual effort is used to collect the device ID, then the token can be bound to the device, but the user must manually enter the device ID upon request into the token generating application
Solution Approach 1:
The system enables self-service device ID collection by having the token generating application automatically retrieve the device ID from the device itself, without requiring manual user input. The application queries the device for its unique identifier and uses this information to bind the token, streamlining the process and eliminating user burden while maintaining accurate device identification.
4Adaptability or versatility
If existing solutions focus on administering the device ID from a central location like a server, then the token binding can be managed centrally, but the system lacks out-of-band authentication capability and cannot be integrated with various platforms
Solution Approach 1:
The system achieves universality by implementing platform-agnostic token binding mechanisms that work across multiple operating systems and device types. The application uses standard device identification APIs available on different platforms, enabling the same token generation and binding process to function on smartphones, tablets, and computers without requiring platform-specific implementations.
Data Source
AI summary
Systems and methods for a secure soft token solution applicable to multiple platforms and usage scenarios are provided. According to one embodiment, a user of a mobile device is prompted to input an activation code previously provided to the user by an authentication server, which authenticates credentials provided by users of a secure network resource that is accessible via an IP-based network. A unique device ID of the mobile device is obtained via an API of an operating system of the mobile device. A seed is requested from a provisioning server. The seed is received in encrypted form based on a combination of a secret key, the unique device ID and a hardcoded-pre-shared key. The seed is bound to the mobile device by encrypting the seed based on the unique device ID. When a token is requested by the user it is generated based on the bound seed.