TOTP Validator Appliance Eliminates Server-Side Secret Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Social networks face significant costs and data storage challenges when implementing Time-based One Time Password (TOTP) authentication, as they need to store device-specific secrets for each user, even for users without an account, which is not feasible with existing technologies that require a writable user object or account storage.
Innovation Solution
A method that securely delivers TOTP secrets to mobile devices, allowing them to generate and validate TOTPs without server-side storage, using a TOTP access appliance that generates secrets based on unique identities and hashes them with a TAA secret, eliminating the need for server-side data storage and enabling TOTP authentication without account requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TOTP authentication is implemented with server-side storage of device secrets, then authentication security is improved, but storage costs and data management complexity increase significantly
Solution Approach 1:
The patent extracts the secret key storage from the server side and places it on the client side (mobile device). The server only stores a public identifier, while the secret key resides exclusively on the client device. This extraction eliminates the need for server-side storage of sensitive authentication data, resolving the contradiction between security and storage costs.
Solution Approach 2:
The patent introduces a cryptographic hash function as an intermediary mechanism. The hash function takes the secret key and generates a derived key that can be verified by the server without storing the original secret. This intermediary allows the server to validate authentication without having access to or storage requirements for the actual secret key.
2Reliability
If device-specific secrets are stored on the server for each user, then TOTP validation is enabled, but data storage requirements and infrastructure costs increase
Solution Approach 1:
The secret key storage is extracted from the server and placed on the client device. The server only maintains minimal public identifiers, while all secret key management occurs locally on the client. This extraction eliminates the need for large-scale secret key storage infrastructure on the server side.
Solution Approach 2:
The client device performs self-service by generating and managing its own secret keys locally. The device uses its unique identifier to generate a secret key that never leaves the device, and independently manages the TOTP generation and validation process without requiring server-side secret key storage.
3Loss of information
If user accounts and identity stores are maintained for TOTP registration, then authentication tracking is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The patent extracts the identity verification function from complex user account management systems and simplifies it to basic device identifier tracking. The server only needs to track public device identifiers rather than maintaining full user accounts, profiles, and permission structures, significantly reducing system complexity while preserving essential authentication tracking.
Data Source
AI summary
A Time-based One-Time Password (TOTP) validator is interposed between a principal and a network service. The validator interacts with a mobile application (app) on the mobile device associated with the principal to dynamically supply a validator secret. The secret and, perhaps, other information are processed by the app to generate a TOTP when the principal attempts to access a protected resource of the network service. The validator independently generates the TOTP and compares the app generated TOTP, and on a successful match, a principal's access device is redirected for access to the protected resource.