Software Authentication System Using Random State Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current remote service authentication methods using identifiers and passwords offer low security, while solutions involving smart cards require additional devices and are prone to desynchronization issues, and software-based authentication is vulnerable to copying and brute force attacks.
Innovation Solution
A user authentication system utilizing existing user devices like mobile phones or personal computers, which generates a single-use access code with a non-predictable part, updated randomly for each use, and uses one-way functions to calculate and validate the access code, ensuring security without the need for external resynchronization mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If smart cards or microprocessor cards are used for secure authentication, then authentication security is improved, but device complexity increases and additional hardware is required
Solution Approach 1:
The patent replaces physical smart cards with a software-based authentication means that copies the security functionality into existing user devices (mobile phones, PDAs, PCs). The authentication means comprises storage means for state variables and a generator for single-use access codes, replicating smart card security without requiring dedicated hardware cards or readers.
Solution Approach 2:
The authentication means is designed to run on existing multi-functional devices (mobile phones, PDAs, PCs) that users already possess. These devices serve multiple purposes including communication, information access, and authentication, eliminating the need for dedicated authentication hardware while maintaining security.
2Ease of operation
If devices with counters or clocks are used for authentication, then authentication functionality is provided, but desynchronization occurs when power supply or clock setting cannot be guaranteed
Solution Approach 1:
The authentication entity proactively initiates state variable updates and sends them to the authentication means before desynchronization can occur. This preliminary action ensures that both parties maintain synchronized state variables without relying on the user's device to maintain accurate clocks or counters over time.
Solution Approach 2:
The system implements a feedback mechanism where the authentication entity receives access codes, validates them, and responds with new state variables. This continuous feedback loop maintains synchronization between the authentication entity and the authentication means, correcting any drift in state variables before it affects authentication.
3Ease of manufacture
If software-based authentication is used, then ease of implementation is improved, but security is compromised due to copying and analysis vulnerabilities
Solution Approach 1:
The authentication system uses dynamic state variables that are continuously updated by the authentication entity and stored in the authentication means. These state variables change with each authentication transaction, making static copying or analysis ineffective. The generator creates single-use access codes that are valid only for one authentication attempt.
Solution Approach 2:
The authentication code is segmented into multiple state variables (at least two state variables) that are updated independently. This segmentation prevents brute force attacks because an attacker would need to simultaneously guess multiple synchronized state variables, exponentially increasing the security complexity while maintaining software-based implementation.
4Reliability
If external resynchronization mechanisms are introduced, then desynchronization issues are addressed, but cost and security consistency deteriorate
Solution Approach 1:
The authentication means automatically receives and applies state variable updates from the authentication entity without requiring external resynchronization interventions. The system self-corrects any desynchronization through the normal authentication feedback loop, eliminating the need for separate resynchronization procedures or mechanisms.
Data Source
Figure 1
Figure 2A~2C
Figure 3~4
AI summary
The invention relates to an authentication system for a user possessing a means (3) for authentication at an authentication entity (1), said authentication means including a means (11) for storing at least one status variable and a single-use access-code generator (2) actuated upon a request of the user, said access code including at least one unpredictable portion and being transmitted to the authentication entity for validation, said validation authenticating the user at the authentication entity, characterised in that the status variable is updated in a random manner by and upon the initiative of the authentication means systematically and before any generation of a new access code, in that the generator is suitable for computing the access code using the status variable once it is updated, and in that the authentication entity is adapted for modifying the value of at least one internal status variable during the at least partial validation of the access code by using information previously known by the authentication entity as well as the unpredictable portion conveyed by the transmitted access code.