Token Authentication System Dynamic Offset Truncation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems using tokens face challenges in synchronizing counters between hardware tokens and authentication servers, leading to potential authentication failures and vulnerabilities to brute force attacks due to truncated OTP values.
Innovation Solution
A method for generating One Time Passwords (OTPs) using a monotonically increasing counter and a static symmetric key, with synchronization achieved by calculating subsequent OTP values and implementing dynamic offset truncation to maintain cryptographic strength, while preventing Denial of Service attacks through careful parameter selection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the OTP value is truncated to reduce user burden, then ease of operation is improved, but security is worsened due to vulnerability to brute force attacks
Solution Approach 1:
The patent introduces a dynamic offset parameter that selects different portions of the hash output for truncation. Instead of always truncating from the beginning, the offset dimension allows selecting from multiple possible truncation points, effectively increasing the search space for attackers while keeping the displayed OTP length short for user convenience.
Solution Approach 2:
The system pre-calculates multiple OTP values using different offset values and stores them in a window buffer before authentication is needed. This preliminary action ensures that when authentication occurs, the system already has multiple candidate OTPs ready, maintaining security against brute force attacks while allowing the interface to display only a short truncated value.
2Reliability
If counter synchronization is implemented between token and server, then authentication reliability is improved, but device complexity is worsened
Solution Approach 1:
The token device autonomously maintains its own counter and generates OTPs based on local state without requiring continuous communication with the server for synchronization. The server simply validates OTPs against its own counter state, and synchronization occurs implicitly through the mathematical relationship of the counter values, eliminating the need for complex active synchronization protocols.
Solution Approach 2:
The counter value acts as an intermediary that bridges the token and server. Both parties maintain their own counters independently, and the OTP generation function serves as a mediator that transforms these counter values into comparable authentication values, allowing synchronization without direct communication between token and server.
3Reliability
If cryptographic strength is maintained through dynamic offset truncation, then security is improved, but computational complexity is worsened
Solution Approach 1:
The system changes the offset parameter dynamically based on the counter value, selecting different portions of the hash output for truncation. This parameter change maintains cryptographic strength by ensuring that the truncation point varies with each OTP, preventing attackers from optimizing their brute force attacks against a fixed truncation pattern, while the computational overhead remains minimal as it only requires adding an offset index.
Data Source
AI summary
A method for calculating a One Time Password. A secret is concatenated with a count, where the secret is uniquely assigned to a token. The secret can be a private key or a shared secret symmetric key. The count is a number that increases monotonically at the token with the number of one-time Passwords generated at the token. The count is also tracked at an authentication server, where it increases monotonically with each calculation of a one-time Password at the authentication server. An OTP can be calculated by hashing a concatenated secret and count. The result can be truncated.