Anonymous Multi-Factor Access Control via Third-Party Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor access control methods rely on the server storing sensitive information for authentication, which compromises security and anonymity, as they require direct access to user data for comparison, making them vulnerable to manipulation and lacking in cryptographic security.
Innovation Solution
A method where the client and server use distinct identification values, with a third-party access control instance generating temporary assignment values for data access, ensuring that neither party can determine access information, and using cryptographic techniques like XOR and secure hash functions to maintain anonymity and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the server stores sensitive information for authentication comparison, then multi-factor access control can be implemented, but security and anonymity are compromised
Solution Approach 1:
The patent introduces a third-party access control instance as an intermediary between the client and server. This mediator performs the authentication comparison without requiring the server to store or process sensitive client authentication data. The intermediary receives authentication factors from the client and compares them against stored values on the server without the server needing to maintain direct trust relationships, thereby resolving the contradiction between implementing access control and maintaining server security.
Solution Approach 2:
The authentication process is segmented into separate functional components: the client provides authentication factors, the access control instance performs comparison, and the server stores reference values. This segmentation allows each component to operate with minimal sensitive data, preventing the server from being vulnerable to manipulation while maintaining secure access control.
2Object-affected harmful factors
If anonymous systems are used to avoid storing personal data, then user anonymity is improved, but user authentication becomes impossible
Solution Approach 1:
The access control instance serves as an intermediary that enables authentication without the server storing personal user data. The system uses pseudonymous identifiers and temporary session tokens that do not reveal real user identities to the server. The intermediary facilitates the authentication process by comparing cryptographic proof without requiring the server to maintain persistent personal data records, thus achieving both anonymity and authentication.
Solution Approach 2:
The system changes the parameters of user identification from permanent personal data to temporary cryptographic values. Instead of storing real user identifiers, the server stores hashed or encrypted reference values that can be compared without revealing user identities. The authentication process uses mathematical operations (hashing, encryption) to create comparable values that maintain anonymity while enabling verification.
3Ease of operation
If direct access to data is granted after authentication, then ease of operation is improved, but security control is reduced
Solution Approach 1:
The access control system implements dynamic, conditional access rather than static direct access. The access control instance evaluates multiple factors and generates temporary session tokens that are valid only for specific operations and time periods. Access rights are dynamically adjusted based on the authentication result and session context, providing both convenience (automatic access upon successful auth) and security (time-limited, condition-based permissions).
Solution Approach 2:
The system performs preliminary authentication verification before granting any data access. The access control instance pre-validates authentication factors and generates secure session tokens in advance. This preliminary action ensures that only properly authenticated users receive access credentials, maintaining security while enabling convenient subsequent data access through the established session.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to methods for storing and finding data of clients (CL) which are identifiable by unique client identifiers (S-CK) on a memory device (SV), wherein these data include at least client data identification values (S-CDI) which the client (CL) assigns arbitrarily to the data, and these data of the client (CL) are found on the memory device (SV) exclusively by means of these client data identification values (S-CDI). An access control entity (ZKI) is provided which has an adaptable positive list (PL) as a listing of the client identifiers (S-CK) of the selected client (CL) which, exclusively in a session setup step, beginning with a session start enquiry, obtain a temporary supplementary information item from this access control entity (ZKI) and with this information item can store and find data on the memory device (SV), each temporary supplementary information item losing its validity after a specific time period.