Two-Step Authentication Token System for Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face frustration and security risks when entering credentials on small devices for authentication, especially with complex passwords, leading to increased user dissatisfaction and potential security breaches due to the proliferation of devices requiring frequent authentication.
Innovation Solution
A network-based system that uses a primary credential for initial authentication, generating a device token and a secondary credential for subsequent logins, where the secondary credential is easier to enter and not stored locally, with the server token encrypted and referenced for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users enter credentials on small devices for authentication, then authentication can be performed, but user frustration increases and security risks arise due to complex passwords and frequent authentication requirements
Solution Approach 1:
The authentication process is segmented into two distinct parts: a primary credential (e.g., fingerprint, facial recognition) that provides secure authentication, and a secondary credential (e.g., PIN, passcode) that is easier to enter on small devices. This segmentation allows the system to maintain high security requirements while improving user convenience during frequent authentication operations.
Solution Approach 2:
A server acts as an intermediary between the device and the authentication verification process. The server stores authentication data and handles the verification of credentials, allowing the small device to avoid storing sensitive authentication information locally while still providing secure authentication. This intermediary role resolves the conflict between security and ease of operation.
2Loss of time
If credentials are stored locally on devices, then authentication speed improves, but security risks increase due to potential compromise by malware and identity theft
Solution Approach 1:
The sensitive authentication data is extracted from the local device and stored on a remote server instead. The device retains only minimal information necessary for initiating authentication (such as a device identifier or biometric template), while the actual credential verification and data storage occur on the secure server infrastructure, eliminating the security vulnerability of local storage.
Solution Approach 2:
Authentication data is pre-configured and stored on the server before the device needs it. When authentication is required, the device quickly communicates with the server to retrieve or verify credentials, eliminating the need for the device to maintain large authentication databases locally while still achieving fast authentication through pre-prepared server-side data.
3Reliability
If complex password guidelines are enforced, then authentication security improves, but user frustration and authentication errors increase
Solution Approach 1:
The mechanical act of typing complex passwords on small device keyboards is replaced with alternative authentication mechanisms such as biometric recognition (fingerprint, facial recognition, iris scanning) or simple touch gestures. This substitution maintains or enhances security while dramatically improving ease of operation, as biometric authentication requires no manual input despite complex security requirements.
Data Source
AI summary
According to an example, to authenticate a user of a computing device, a user login request with at least one primary credential is received from a computing device. At least one primary credential is validated to authenticate the user, and a first device token is created and transmitted to the computing device. A secondary credential is received from the computing device, and a server token and a reference to the server token is created. The server token is encrypted and stored and the server token reference is sent to computing device for use in a subsequent authentication with the secondary credential.