Authentication on the Client Device

There are two forms of authentication on the client device:

• User Authentication: the end user authenticates with the device through an alphanumeric Personal Identification Number (PIN)

• Gateway Authentication: the end user authenticates with the Gateway Engine through a username and password

The MEP client library provides an API to validate an arbitrary length alphanumeric PIN against a PIN derivative stored on the device. The library also maintains a count of validation attempts (even across restarts of the application). If a threshold of failed attempts is exceeded (specified by the client application), data destruction and device lockout can occur.

Storing the PIN derivative and a count of validation attempts on the device is an obvious weakness in the security architecture, as this data could be easily subverted. Therefore, it is recommended that users follow the best practices outlined above to improve the overall security of the system.

Supplying the correct PIN allows users to access the application and perform local operations, but users will not be able to synchronize with the Gateway Engine unless they supply the proper username/password credentials for the Gateway Engine.

Authentication Implementation

Let:

	S = alphanumeric secret (random key sequence entered exactly once by user)
	S' = md5sum( S )

	P = alphanumeric PIN (entered by user every time)
	P' = md5sum( P )

	cipherText = encrypt( S, P' )

	persist { S', cipherText } on the device

Upon subsequent logins:

	P = PIN
	P' = md5sum( P )
	plainText = decrypt( cipherText, P' )

	if ( md5sum( plainText ) == S' )
		success
	else
		failure