Authenticator Authorization via Signed Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In biometric authentication systems, there is a challenge in securely authorizing new authenticators on client devices without compromising the integrity and authentication strength, especially when the biometric device is remote from the security boundary and may be compromised or replaced, leading to uncertainty about its authorization status.
Innovation Solution
A method and system that allows a new authenticator on a client device to be enabled and registered using an existing, trusted client device that is already registered with relying parties, by establishing a secure connection and transferring registration data, generating new key pairs, and creating a signed authorization object to verify and synchronize registrations across multiple devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a new authenticator is added to a client device, then the functionality and versatility of the authentication system is improved, but the security risk and uncertainty about authorization status increases
Solution Approach 1:
The system performs preliminary authorization verification by having the new authenticator sign a challenge message with its private key before full registration. This preliminary cryptographic proof of identity allows the client device to verify the authenticator's legitimacy in advance, ensuring authorization status is established before the authenticator becomes fully operational.
Solution Approach 2:
The client device acts as an intermediary between the new authenticator and the authentication server. It verifies the authenticator's identity through cryptographic challenges and then registers the authenticator with the server, mediating the authorization process to ensure security while enabling functionality.
2Reliability
If biometric reference data is stored locally on the client device, then the authentication strength and security against network attacks is improved, but the device complexity and storage requirements increase
Solution Approach 1:
The system extracts and stores only the essential biometric reference data locally on the client device in secure storage, while keeping the authentication server as a remote verification authority. This selective extraction provides sufficient authentication strength for local verification while avoiding the need to store excessive data that would increase device complexity.
3Reliability
If a secure connection is established for transferring registration data, then the security and integrity of data transmission is improved, but the time and complexity of the authorization process increases
Solution Approach 1:
The client device and new authenticator establish secure connections and perform cryptographic verification in advance during the authorization process. By performing these security-critical operations preliminarily before full registration, the system ensures data transmission security while enabling faster subsequent authentication operations.
Data Source
AI summary
A system, apparatus, method, and machine readable medium are described for authorizing a new authenticator with a relying party. For example, one embodiment of a method comprises: identifying a plurality of relying parties with which an old authenticator is registered; generating at least one key for each of the plurality of relying parties; authenticating with each of the relying parties using a client having the old authenticator configured thereon, the client authorizing the new authenticator by providing an authorization object to each relying party comprising the at least one key, data identifying the new authenticator, and cryptographic data to be used by the relying party to verify the authorization object; and wherein, in response to verifying the authorization object, each relying party registers the new authenticator.