Authentication Tunneling for Remote Proximity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems struggle to implement proximity-based authentication for remote connections, as users accessing resources via a remote connection between a client machine and a remote machine do not have direct access to the remote machine.
Innovation Solution
A method for authentication tunneling at a remote machine, where an authentication prompt is transmitted to a client machine via an encrypted channel between a first authenticator application on the remote machine and a second authenticator application on the client machine. The client machine responds with user verification data, which is then used to generate and transmit a second authentication response to an identity management system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proximity-based authentication is implemented for remote connections, then authentication security is improved, but device complexity increases
Solution Approach 1:
The patent introduces an identity management system as an intermediary between the client machine and remote machine. This mediator handles the complex authentication process by receiving authentication requests, verifying credentials, and coordinating the challenge-response protocol between machines, thereby improving security without requiring complex authentication logic to be implemented directly in the remote connection protocol
Solution Approach 2:
The authentication process is segmented into distinct components: credential storage in secure enclaves on each machine, challenge generation by the identity management system, local verification of challenges, and coordinated response. This segmentation allows each component to remain relatively simple while the overall system achieves high security through the coordinated interaction of these modular elements
2Reliability
If additional hardware or devices are required for authentication, then authentication reliability is improved, but ease of operation deteriorates
Solution Approach 1:
The patent enables each machine (client and remote) to perform authentication verification locally using secure enclaves that store credentials and verify challenges independently. This self-service capability eliminates the need for additional external hardware devices, as the machines themselves provide the authentication functionality, thereby maintaining high reliability while preserving ease of operation
Solution Approach 2:
The secure enclave functionality is integrated into the existing operating system infrastructure of each machine, allowing the same hardware component to serve both general computing purposes and specialized authentication verification. This multi-functionality eliminates the need for dedicated authentication hardware while maintaining authentication reliability
Data Source
AI summary
A method for authentication tunneling is described. The method includes transmitting an authentication prompt to a client machine via an encrypted channel between a first authenticator application running on the remote machine and a second authenticator application running on the client machine. The authentication prompt may be associated with accessing resources via an identity management system. The method may further include receiving, from the client machine via the encrypted channel, a first authentication response comprising user verification data, an identifier of the client machine, and a first digital signature of the second authenticator application. The method may further include generating, by the first authenticator application running on the remote machine, a second authentication response comprising the user verification data, the identifier of the client machine, an identifier of the remote machine, the first digital signature, and a second digital signature of the first authenticator application.