Authentication Server Shared Account Device ID Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing two-step authentication procedures for shared user accounts, particularly when using the RADIUS protocol, face challenges in securely authenticating multiple users without compromising security or usability, especially when multiple authentication devices are involved.
Innovation Solution
The authentication server requests and verifies a user-specific authentication device ID during the initial login, allowing the second authentication step to proceed only with registered devices, thus ensuring security and compatibility with the RADIUS protocol without requiring changes to existing systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a shared user account is used by multiple users, then ease of operation is improved, but security deteriorates because the authentication device ID cannot be uniquely associated with a specific user
Solution Approach 1:
The patent segments the authentication process into two distinct parts: first verifying the shared account credentials (username/password), then separately verifying the authentication device ID. This segmentation allows the system to maintain both shared account accessibility and device-level security, as each layer independently validates a different aspect of authentication.
Solution Approach 2:
The system performs preliminary registration of authentication device IDs associated with the shared account before the actual authentication occurs. During registration, the system stores the device ID in association with the account. This preliminary action enables the authentication phase to quickly verify the device ID without compromising security, as the device has already been pre-authorized for use with the shared account.
2Ease of operation
If multiple authentication device IDs are registered for a shared account, then ease of operation is improved, but device complexity increases
Solution Approach 1:
The authentication server is designed with universal functionality to handle both single-device and multi-device scenarios for shared accounts. The system maintains a flexible data structure that can store one or more authentication device IDs per account, and the authentication process automatically adapts to verify any registered device. This multi-functionality eliminates the need for separate authentication flows for different device configurations.
3Reliability
If authentication device ID verification is added to the login process, then security is improved, but productivity deteriorates due to additional authentication steps
Solution Approach 1:
The patent merges the authentication device ID verification into the existing RADIUS challenge-response authentication flow. Instead of adding a separate authentication step, the device ID verification is integrated as part of the challenge-response mechanism. The server issues a challenge that includes verifying the device ID, and the client responds with the appropriate credentials. This merging allows security enhancement without requiring users to undergo a distinct additional authentication process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a method and authentication server (50) for authentication of users requesting access to a restricted data resource (40) from a communication device (10). Communication between the communication device (10) and the authentication server (50) passes via an access server (60), and the RADIUS protocol is used for the communication between the authentication server (50) and the access server (60). After validating password and username entered by a user, the authentication server (50) sends a request to the communication device (10) to enter an authentication device ID. When receiving an entered authentication device ID, the authentication server (50) performs authentication of the user based on a second authentication procedure using the received authentication device ID and when the second authentication procedure is successful, the user is granted access to the restricted data resource (40). By sending such a request to the communication device of authentication device ID, the user can decide which of a plurality of different authentication devices to use, which has not been possible to do with the state-of-the-art way of using the RADIUS protocol.