Bi-Level Authentication for Dynamic Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in securely managing and authenticating encrypted data on mobile devices that are used across different locations and roles, as existing solutions fail to dynamically adapt to changing situational data and roles, leading to potential unauthorized access and data breaches.
Innovation Solution
A system that employs bi-level authentication using a physical device authentication key and a transient key, which is activated or deactivated based on situational data, ensuring that access to encrypted data is restricted dynamically and in real-time, utilizing an authentication manager and monitor to validate and manage these keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single authentication key is used for data access, then the system is simple to manage, but security is insufficient against unauthorized access across different locations and roles
Solution Approach 1:
The authentication key is segmented into two distinct components: a persistent authentication key stored in the secure element and a transient situational key generated dynamically. This segmentation allows the persistent key to remain simple while the transient key provides enhanced security for specific access contexts, resolving the contradiction between security and complexity.
Solution Approach 2:
The system introduces dynamic key generation where a transient situational key is created on-demand based on current device location and role. This dynamic approach enhances security for each access attempt while the persistent key maintains long-term simplicity, balancing security improvement with manageable complexity.
2Adaptability or versatility
If authentication is static and does not change with situational data, then the system is easy to operate, but it cannot adapt to changing device locations and roles leading to potential unauthorized access
Solution Approach 1:
The transient situational key is dynamically generated and validated based on current device location and role information. This dynamic authentication mechanism adapts to changing situational data while the persistent key provides stable long-term authentication, achieving adaptability without excessive complexity.
Solution Approach 2:
The transient situational key acts as an intermediary between the persistent authentication key and the data access permission. It translates static persistent key authentication into dynamic situational-specific access control, enabling adaptability while maintaining manageable system complexity through the intermediary layer.
3Reliability
If data access is continuously monitored and controlled based on situational data, then unauthorized access is prevented, but system performance may be impacted due to continuous validation requirements
Solution Approach 1:
The persistent authentication key validates user identity in advance before data access is attempted. This preliminary authentication establishes trust, allowing the subsequent transient key validation to focus only on situational data rather than complete re-authentication, thereby maintaining security while improving access speed.
Solution Approach 2:
The authentication process is segmented into two stages: persistent key validation for user identity (fast, one-time) and transient key validation for situational data (fast, per-access). This segmentation allows continuous monitoring and control without performance impact, as each stage operates independently and efficiently.
Data Source
AI summary
Embodiments relate to a system, program product, and method for use with a physical computing device to process a data access request. The requested data is encrypted with two keys, including a physical device authentication key and a transient key. Access to the data requires authentication on both the device level and situational level. Device situational data is monitored, which includes selectively enabling access to the requested data and de-activation of the transient key in response to a change in the monitored situational data. The transient key de-activation removes access to the requested data.