Two-Device Authentication Using Segmented One-Time Passwords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for accessing electronic resources often rely on single-factor authentication, which can be vulnerable to unauthorized access, as they do not effectively utilize multiple devices to enhance security.
Innovation Solution
A two-mobile device authentication system where a first mobile device stores one-time password generation routines and a second mobile device stores supplemental authentication values, with the first mobile device generating a one-time password using both, ensuring that access to the password is restricted to both devices, thereby increasing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single-factor authentication is used, then ease of operation is improved, but security is worsened
Solution Approach 1:
The authentication system is segmented into two separate mobile devices: a first mobile device that stores one-time password generation routines and a second mobile device that stores supplemental authentication values. This segmentation ensures that neither device alone can compromise security, as both components are required to generate a valid one-time password, thus resolving the contradiction between ease of operation and security.
2Reliability
If multiple authentication factors are stored on a single device, then security is improved, but device complexity is worsened
Solution Approach 1:
Authentication credentials are segmented across two mobile devices to avoid concentrating all security factors in one device. The first device holds password generation routines while the second holds supplemental values, distributing complexity and reducing the security risk associated with single-device storage.
Solution Approach 2:
The system introduces an intermediary communication protocol between the two mobile devices. The first device requests supplemental authentication values from the second device, which acts as a mediator providing only the necessary data without exposing the entire authentication mechanism, thus maintaining security while managing complexity.
3Reliability
If supplemental authentication values are transmitted between devices, then security is improved, but loss of information is worsened
Solution Approach 1:
The second mobile device acts as an intermediary that provides supplemental authentication values only in response to authenticated requests from the first device. This controlled intermediary relationship ensures that sensitive data is transmitted only when necessary and only to authorized components, minimizing data exposure risk while maintaining security.
Solution Approach 2:
The system implements a mechanism where supplemental authentication values are temporarily provided to the first device for generating a single one-time password, then discarded from the first device after use. This ephemeral data handling approach minimizes the window of opportunity for data exposure while enabling secure authentication.
Data Source
AI summary
Techniques are disclosed relating to a computer system including a first mobile device that stores information that is inaccessible without a value stored on a second mobile device. In some embodiments, the first mobile device stores a plurality of one-time password generation routines executable to generate one-time passwords usable to authenticate user access to an electronic resource, and the second mobile device stores a plurality of supplemental authentication values that correspond to the one-time password generation routines. A particular one-time password generated by the first mobile device using a particular one-time password generation routine is inaccessible without the corresponding particular supplemental authentication value stored on the second mobile device. In embodiments, the particular supplemental authentication value is sent to the first mobile device and the corresponding particular one-time password generated by the first mobile device using the corresponding particular one-time password generation routine becomes accessible.