Token-Based Authentication Preventing Password Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information systems face challenges in ensuring the security and efficiency of user authentication, particularly in preventing unauthorized access while optimizing technical operations, as traditional username-password methods risk password exposure during transit.
Innovation Solution
Implementing token-based authentication techniques, where a client device generates a time-based one-time passcode (T-OTP) based on a user's password, which is then validated by the server, reducing the need to send the password and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional username-password authentication is used, then the authentication process is simple and straightforward, but the password may be exposed during transit compromising security
Solution Approach 1:
The patent extracts the password from the authentication transmission process by using it only for token generation on the client side. The actual authentication is performed using a token that does not contain the password, thereby removing the security vulnerability of password exposure during transit while maintaining authentication functionality.
Solution Approach 2:
The patent introduces a token as an intermediary element between the client and server authentication process. The token serves as a mediator that carries authentication information without exposing the password, allowing secure verification while preventing direct password transmission.
2Ease of operation
If password is transmitted for authentication, then the authentication process is straightforward, but the password exposure risk increases during transit
Solution Approach 1:
The password is extracted from the transmission path and used solely for local token generation. The authentication request then contains only the token, eliminating password exposure risk while keeping the user experience similar to traditional authentication.
Solution Approach 2:
The client generates a copy of the authentication credential in the form of a token based on the password, but without transmitting the original password. This copy contains sufficient information for verification while being safe to transmit.
3Reliability
If token-based authentication is implemented, then password exposure during transit is minimized, but the authentication process becomes more complex
Solution Approach 1:
The client device performs self-service by generating the token locally using the password and synchronization code, without requiring server intervention for token creation. This reduces server processing load and maintains operational efficiency while enhancing security.
Solution Approach 2:
The token is generated in advance by the client before the authentication request is sent to the server. This preliminary action eliminates the need for the server to handle password processing, improving operational efficiency while maintaining strong security.
Data Source
AI summary
Aspects of the disclosure relate to providing information security and preventing unauthorized access to secured resources by implementing token-based authentication techniques. A computing platform may receive, from a client computing device, a request to authenticate a user to a user account associated with a client portal provided by a client portal server. In response to receiving the request to authenticate, the computing platform may generate a validation token for the user account. Subsequently, the computing platform may validate the request to authenticate based on the validation token generated for the user account. In response to validating the request to authenticate, the computing platform may generate and send one or more commands directing the client portal server to provide at least one client portal interface to the client computing device. In some instances, receiving the request to authenticate may include receiving a time-based one-time passcode generated by the client computing device.