Authenticator System Multi-Device Registration via Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User authentication via 'what you have' devices is vulnerable to loss, leading to account lockout or denial of access, as users may not have multiple devices available during registration and risk losing all devices simultaneously.
Innovation Solution
An authenticator system using a processor and communication interface to generate public-private key pairs for authentication, allowing registration and verification through a challenge/response protocol, with an initial authenticator registering and associating with a relying party and a further authenticator, enabling secure access even if one device is lost.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a user registers only one authentication device, then the registration process is simple and quick, but the system becomes vulnerable to account lockout if the device is lost
Solution Approach 1:
The system performs preliminary registration of multiple authentication devices during the account setup phase. The initial authenticator registers a first authentication device, then proactively facilitates registration of a second authentication device before any loss scenario occurs. This preliminary action ensures redundancy is established in advance, so when a device is lost, the user already has a backup registered and can immediately access their account without lockout.
2Reliability
If a user registers multiple authentication devices simultaneously, then access reliability is improved, but the registration process becomes complex and time-consuming
Solution Approach 1:
The authentication device registration process is segmented into distinct phases: first, the initial authenticator registers the first authentication device; second, the system generates and transmits authentication information to enable registration of a second authentication device. This segmentation allows the complexity to be distributed across separate steps rather than requiring simultaneous configuration of multiple devices, making the overall process more manageable while still achieving the reliability benefit of having multiple registered devices.
Solution Approach 2:
The patent introduces an intermediary mechanism where the initial authenticator acts as a mediator to facilitate registration of the second authentication device. The initial authenticator generates authentication information (such as security tokens or verification codes) that are transmitted to the user, who then uses this information to register the second authentication device. This intermediary approach simplifies the registration process by providing automated guidance and verification, reducing the complexity burden on the user while ensuring proper registration of multiple devices.
3Reliability
If the system requires multiple authentication devices to be available during registration, then security is improved, but users may not have multiple devices available when creating an account
Solution Approach 1:
The system implements a dynamic registration approach where the authentication requirements adapt based on the current state of device availability. During the initial account creation phase, the system accepts registration of a single authentication device through the initial authenticator. After this baseline is established, the system dynamically enables and guides the user through an additional registration phase where a second authentication device can be registered. This dynamic adaptation allows the system to maintain security standards while being flexible about when and how multiple devices are registered, accommodating users who may not have multiple devices immediately available during account creation.
Data Source
AI summary
Examples provide machine readable storage storing instructions arranged, when processed, to facilitate authentication using an authenticator, the instructions comprising instructions to generate, by an initial authenticator, authentication data associated with a further authenticator; the authentication data comprising private data and a public credential; the public credential and private data being for use in producing authentication information to authenticate the further authenticator to a relying party; and send data derived from the authentication data to network storage commonly accessible by the initial authenticator and the further authenticator.