Asynchronous Step-Up Authentication for IoT Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT transaction authorization systems rely on trust that proper authentication has been obtained by client applications, which can lead to security concerns when transactions are made without the user's permission, especially in shared device scenarios.
Innovation Solution
Implementing a step-up authentication process that uses existing trusted authenticators and decouples IoT devices and integration applications from additional authentication, allowing for asynchronous execution and the use of a second access token for high-risk transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If trust-based authentication is used for IoT transactions, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent segments the authentication process into two distinct phases: initial authentication (first access token) and step-up authentication (second access token). This segmentation allows the system to maintain ease of operation for routine transactions while enhancing security for high-risk transactions through the additional authentication layer.
Solution Approach 2:
The patent implements dynamic authentication requirements based on transaction risk assessment. The system dynamically determines whether step-up authentication is needed by evaluating transaction characteristics, device status, and user behavior patterns. This dynamic approach maintains ease of operation for low-risk transactions while applying enhanced security measures only when necessary.
2Reliability
If step-up authentication is implemented for all transactions, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent applies step-up authentication partially rather than universally. The system performs risk assessment and applies enhanced authentication only to transactions that meet specific risk criteria, rather than requiring it for all transactions. This partial application maintains security for high-risk cases while avoiding the complexity overhead for routine transactions.
Solution Approach 2:
The patent changes the authentication parameter dynamically based on transaction characteristics. The system evaluates multiple parameters (transaction amount, device status, user behavior patterns, time of day) and adjusts the authentication requirement accordingly. This parameter-based approach allows the system to maintain security while adapting complexity to actual risk levels.
3Measurement precision
If synchronous authentication is used, then measurement precision is improved, but loss of time is worsened
Solution Approach 1:
The patent performs preliminary risk assessment and authentication type determination before the actual authentication process. By pre-evaluating transaction characteristics and determining the appropriate authentication level in advance, the system avoids unnecessary authentication steps and reduces overall authentication time while maintaining security accuracy.
Solution Approach 2:
The patent implements asynchronous step-up authentication that allows the initial transaction request to proceed while the enhanced authentication is performed in the background. This continuous processing approach maintains authentication accuracy through thorough verification while minimizing user wait time by overlapping authentication steps rather than executing them sequentially.
Data Source
AI summary
Embodiments described herein disclose methods and systems for authorizing transactions received from client applications. The transaction request can include a first access token. After validating the first access token, the system can determine whether additional authentication is needed to authorize the transaction. If additional authentication is needed, the system can determine the authentication requirements. Once the additional authentication is received and verified, the system can generate a second access token and authorize the transaction by releasing the first access token.