Secure Peripheral Authentication for Continuous Service Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for user access through a user access device to a server application do not align with the zero trust security model, as they do not regularly verify user identity, and long-lived security authorization tokens can be vulnerable to breaches.
Innovation Solution
Implement a method where a secure peripheral device checks user identity during ongoing application flows using biometric data and secret device keys, generating responses based on user data comparisons and time validity, ensuring continuous verification and secure REST API calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user identity is checked once and for all via VNP solution, then user access to server services is granted, but security vulnerability increases due to long-lived tokens not aligning with zero trust model
Solution Approach 1:
The system performs periodic authentication by validating tokens at regular intervals during the user session. The server application periodically requests token validation from the VNP solution, ensuring that user identity is continuously verified rather than relying on a single long-lived authentication. This periodic action aligns with the zero trust security model while maintaining efficient access control.
Solution Approach 2:
The system implements feedback mechanisms where the VNP solution continuously provides authentication status information to the server application. The server receives real-time feedback about token validity and user identity, allowing it to dynamically adjust access decisions. This feedback loop ensures continuous verification without requiring repeated full authentication processes.
2Reliability
If continuous identity verification is implemented during ongoing application flows, then security is improved according to zero trust model, but system complexity increases
Solution Approach 1:
The VNP solution acts as an intermediary between the user access device and the server application. It handles the complex tasks of token generation, validation, and periodic authentication, shielding the server application from direct implementation complexity. The VNP solution mediates all authentication-related communications, centralizing the complex security logic in a dedicated component.
Solution Approach 2:
The authentication system is segmented into distinct functional components: the VNP solution handles token management and validation, while the server application focuses on business logic and access control decisions. This segmentation allows each component to be optimized independently, reducing overall system complexity while maintaining continuous verification capabilities.
3Reliability
If token validity is periodically validated during user session, then security authorization is improved, but processing time increases
Solution Approach 1:
The system performs preliminary authentication actions during user login, where the VNP solution generates and validates tokens in advance. By completing thorough authentication checks upfront and establishing valid tokens, the system reduces the need for repeated time-consuming validation processes during the user session, minimizing processing overhead while maintaining security.
Data Source
AI summary
A method for granting a user access through a user access device hosting a client application to a service of a server application hosted by a server includes sending by a server application a user authentication request, a primary challenge, an URL, and a unique user identifier to a secure peripheral device hosting a device application, checking the user identity, building a flag using the result of a comparison between user data signals and the ones that have been stored during a user-device binding process, generating a primary response, sending the primary response to the server, verifying the validity of the primary response, and granting or denying the user access to the service.