Physical Access Token Authentication via Local Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyberattacks, particularly those involving interception and manipulation of communication between legitimate devices, pose a growing risk in interconnected systems, threatening sensitive data and leading to unauthorized access, identity theft, and operational disruptions in medical and educational settings.
Innovation Solution
A secure authentication mechanism using physical access tokens that verify authentication data generated independently on both the token and remote server without transmitting sensitive data, ensuring that even if intercepted, the data is unique to each session and cannot be reverse-engineered, utilizing hash-based values and deterministic functions to validate user access without exposing sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physical access tokens transmit authentication data to verify user identity, then authentication reliability is improved, but vulnerability to interception and manipulation attacks increases
Solution Approach 1:
The patent extracts only the essential authentication verification function from the communication process. Instead of transmitting sensitive authentication data (passwords, keys, record identifiers), the system transmits only a verification request and receives only a verification result. The actual authentication data remains localized on the server and token device, eliminating the transmission of sensitive information while maintaining authentication reliability.
Solution Approach 2:
The patent introduces an intermediary verification mechanism that does not require direct transmission of sensitive authentication data. The access terminal acts as an intermediary that transmits only verification requests containing non-sensitive parameters (such as timestamps or random values) and receives verification results. This intermediary process allows authentication verification without exposing sensitive data to interception or manipulation.
2Ease of operation
If sensitive authentication data is transmitted for verification, then authentication functionality is improved, but risk of data breach and identity theft increases
Solution Approach 1:
The patent extracts and transmits only the minimal necessary information for verification purposes. Instead of transmitting sensitive authentication data such as passwords or cryptographic keys, the system transmits only verification requests with non-sensitive parameters and receives verification results. This extraction approach maintains authentication functionality while eliminating the transmission of data that could lead to breaches or identity theft.
Solution Approach 2:
The patent inverts the traditional authentication approach by having the server verify the token without receiving the token's sensitive data. Instead of the token transmitting its authentication data to the server, the server sends verification requests and the token responds with verification results generated locally. This inversion ensures that sensitive data never leaves the token device, preventing data breaches and identity theft while maintaining full authentication functionality.
3Speed
If authentication data is transmitted and stored for future use, then authentication speed is improved, but security against replay attacks deteriorates
Solution Approach 1:
The patent implements periodic action by generating unique verification data for each authentication session. The verification requests include time-dependent parameters such as timestamps or session-specific random values, ensuring that each authentication transaction is unique. This periodic regeneration of verification data prevents replay attacks while maintaining fast authentication speed, as the verification process remains efficient without requiring data storage for future use.
Solution Approach 2:
The patent applies dynamics by making authentication data dynamic and session-specific rather than static and reusable. The verification data changes with each authentication session based on timestamps, random values, or other dynamic parameters. This dynamic approach ensures that even if verification data is intercepted during one session, it cannot be reused in another session, preventing replay attacks while maintaining authentication speed through efficient real-time verification.
Data Source
AI summary
In certain embodiments, a physical network access token at a network access terminal may be authenticated for modification of records at a remote server system. In some embodiments, a set of records and counterpart records having the same record identifiers and resource amounts may be stored independently on a physical token or user device and the remote server system. When a connection is established between an access terminal and the physical token (e.g., for authenticating a modification of record(s)), the access terminal may transmit input data to the token, which may use the input data with the records stored on the token to generate authentication data, which may be used by the remote server to authenticate a network action requested via the token.