Authenticator Key Generation for Device Loss Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User authentication systems based on 'what you have' are vulnerable to users being locked out of accounts or denied access if they lose their authentication devices, and there is a risk of losing multiple devices simultaneously, especially when multiple devices are not available during registration or if all devices are lost at once.
Innovation Solution
A system where multiple authentication devices share a secret seed data, allowing one authenticator to generate and provide authentication data for other devices, enabling access to resources even if not all devices are present, through a key generator and communication interface that supports interactions with relying parties, using private-public key pairs and challenge/response protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple authentication devices are used to improve reliability, then the risk of being locked out is reduced, but the complexity of managing multiple devices increases
Solution Approach 1:
The authentication system is segmented into multiple independent authenticators that can function individually. Each authenticator holds a share of the private key, allowing independent authentication operations. This segmentation enables users to authenticate with any single device without needing all devices, reducing management complexity while maintaining reliability.
Solution Approach 2:
Multiple authenticators are designed with universal functionality to perform the same authentication task. Each authenticator can independently generate authentication data for the same resource, making them interchangeable. This universality simplifies user experience as any device can serve any authentication need without requiring device-specific procedures.
2Reliability
If users register multiple authentication devices independently, then access continuity is improved, but the registration process becomes more complex and time-consuming
Solution Approach 1:
The system performs preliminary action by pre-configuring multiple authenticators with shared private key components before the user needs authentication. The authenticators are pre-registered with the relying party system, so when authentication is needed, the user can immediately use any available device without undergoing registration procedures at the time of use.
Solution Approach 2:
Instead of requiring users to manually register each authenticator independently, the system uses copying by distributing identical authentication capabilities across multiple devices. Each authenticator receives a copy of the authentication share and can independently perform authentication, eliminating the need for repeated registration procedures.
3Object-affected harmful factors
If all authentication devices must be present for access, then security is maintained, but the risk of complete lockout increases when devices are lost
Solution Approach 1:
The private key is segmented into multiple shares distributed across different authenticators. To access the resource, only a threshold number of these segmented key shares are needed, not all of them. This segmentation maintains security by requiring multiple authenticators while improving reliability by allowing access with any sufficient subset, preventing complete lockout when devices are lost.
Solution Approach 2:
The system provides beforehand cushioning by preparing multiple authentication devices in advance with distributed key shares. This cushioning protects against the harmful effect of device loss by ensuring that if some devices are lost, the remaining devices still contain sufficient key material for authentication, thereby maintaining both security and access availability.
Data Source
AI summary
Examples relate to machine readable storage storing instructions arranged, when processed, to implement authentication using an authenticator, the instructions comprising instructions to: generate, by an initial authenticator, a public key associated with a further authenticator using a secret associated with the initial authenticator and the further authenticator; and output the public key associated with the further authenticator for sending to a relying party.