Authentication Capability Query System for Privacy and Efficiency

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing user authentication systems over networks require clients to communicate exhaustive lists of authentication capabilities, compromising privacy and efficiency, and often result in errors due to expired random challenges.

Innovation Solution

Implementing a query policy where the secure transaction server transmits a server policy to the client, allowing the client to identify a subset of supported authentication capabilities, enabling multiple device provisioning and management, and automatically requesting new challenges when previous ones expire.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If clients communicate exhaustive lists of authentication capabilities to the server, then the server can verify all capabilities, but privacy is compromised and communication efficiency decreases

Engineering Contradiction:

Improveauthentication verificationVSAvoidprivacy

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent extracts only the necessary authentication capability information from the exhaustive list and transmits it to the server. Instead of sending all authentication capabilities, the system identifies and transmits only those capabilities that are relevant for the current authentication context, thereby reducing privacy loss while maintaining verification reliability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The authentication capabilities are segmented into different categories or levels of detail. The system transmits segmented information based on what the server needs to verify, rather than transmitting the complete exhaustive list. This segmentation allows the server to perform verification on essential capabilities while the client retains privacy over other capabilities.

Inventive Principle:

Principle #1Segmentation

2Reliability

If clients communicate exhaustive lists of authentication capabilities, then the server can verify all capabilities, but communication efficiency and processing speed decrease

Engineering Contradiction:

Improveauthentication verificationVSAvoidauthentication processing speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system extracts and transmits only the essential authentication capability information needed for verification, removing unnecessary data from the communication stream. This extraction reduces the volume of data transmitted and processed, thereby improving communication efficiency and authentication processing speed while maintaining verification reliability.

Inventive Principle:

Principle #2Taking out (Extraction)

3Device complexity

If the server uses fixed random challenges for authentication, then the protocol is simple to implement, but errors occur when challenges expire

Engineering Contradiction:

Improveprotocol implementationVSAvoidauthentication accuracy

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The patent implements dynamic random challenges that are generated with expiration timestamps. Instead of using fixed static challenges, the system creates challenges that are valid only within a specific time window. This dynamic approach prevents errors from expired challenges while maintaining protocol implementation feasibility through standardized time-based validation logic.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs preliminary actions by generating random challenges with embedded expiration times before authentication occurs. The client and server both prepare for potential challenge expiration by implementing timeout handling and automatic challenge renewal mechanisms, preventing authentication errors before they occur.

Inventive Principle:

Principle #10Preliminary action

4Device complexity

If the system processes authentication devices sequentially, then the implementation is straightforward, but authentication efficiency and user experience deteriorate

Engineering Contradiction:

Improveprocessing implementationVSAvoidauthentication throughput

Core Design Contradiction:

Device complexityVSProductivity

Solution Approach 1:

The patent merges multiple authentication device processing operations into concurrent parallel execution. Instead of processing devices one after another sequentially, the system combines multiple authentication requests and processes them simultaneously, thereby improving authentication throughput and efficiency while maintaining implementation feasibility through standardized processing pipelines.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS10404754B2Query system and method to determine authentication capabilities

Publication Date: 2019.09.03 NOK NOK LABS INC

AI summary

A system, apparatus, method, and machine-readable medium are described for determining the authentication capabilities. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.