Token Apparatus Altering One-Time Passcodes via User Input
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional token systems are vulnerable to sniffing attacks where attackers can replicate token functionality by acquiring secret seeds, allowing unauthorized access to the system.
Innovation Solution
Implementing a token apparatus and authentication system that generates and alters one-time passcodes (OTPs) using user-input alteration codes, which are synchronized with a remote authentication server, making it difficult for attackers to succeed in rainbow attacks by obscuring the OTPs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional token systems use static secret seeds for OTP generation, then the authentication process is simple and efficient, but the system becomes vulnerable to rainbow attacks where attackers can replicate token functionality
Solution Approach 1:
The patent implements dynamic alteration codes that change with each authentication transaction. Instead of using a static secret seed, the system generates time-varying alteration codes that are applied to OTPs, making the authentication process dynamic and resistant to static analysis attacks like rainbow attacks.
Solution Approach 2:
The patent introduces an alteration code as an intermediary layer between the secret seed and the final OTP. This intermediary component obscures the relationship between the seed and the OTP, preventing attackers from directly replicating token functionality even if they obtain seeds.
2Reliability
If alteration codes are implemented to obscure OTPs, then security against sniffing attacks is improved, but the ease of operation decreases due to additional user input requirements
Solution Approach 1:
The patent applies alteration codes selectively to specific portions of the OTP or uses a standardized subset of alteration operations. This partial application reduces the burden on users while still providing sufficient security obscuration to prevent sniffing attacks.
Solution Approach 2:
The system changes parameters of the OTP through standardized alteration operations (such as permutation, substitution, or transformation of specific digits). This allows security enhancement through parameter modification without requiring completely new authentication procedures.
3Reliability
If synchronization is required between token devices and authentication servers for alteration codes, then security verification is improved, but the loss of time increases due to additional communication overhead
Solution Approach 1:
The patent establishes synchronization protocols where alteration codes are pre-coordinated between the token device and authentication server. By performing preliminary synchronization, the system ensures that both parties have the necessary alteration codes ready before authentication occurs, minimizing real-time communication overhead.
Data Source
AI summary
A token apparatus is described, including (a) a controller, the controller being configured to generate an OTP in synchronization with a remote authentication server, (b) a display, the display being constructed and arranged to display the OTP, and (c) an input apparatus, the input apparatus being constructed and arranged to receive a user-input alteration code, the user-input alteration code being used to alter the OTP in a standardized manner. A method of operating a token device which displays an OTP in synchronization with a remote authentication server is described, including (a) receiving an alteration code, (b) entering the alteration code onto the token device, and (c) causing an altered OTP to be entered into an application that seeks to authenticate a user, the altered OTP having been generated from the OTP in a standardized manner based on the alteration code. An authentication system is also described.