Bluetooth Proximity MFA to Prevent Push Fatigue Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing MFA systems are vulnerable to MFA fatigue attacks and lack continuous monitoring of user proximity, allowing unauthorized access when the user is away from the primary device.
Innovation Solution
Utilize Bluetooth pairing information to determine the proximity between a primary and secondary device, sending MFA push notifications only when they are within a threshold proximity, and continuously monitor this proximity to terminate sessions if the devices become too far apart.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MFA push notifications are sent to the secondary device regardless of proximity, then authentication can be completed, but the system becomes vulnerable to MFA fatigue attacks and unauthorized access when user is away
Solution Approach 1:
The system dynamically adjusts the authentication behavior based on real-time proximity conditions. When the secondary device is within threshold proximity of the primary device, push notifications are sent normally. When proximity threshold is exceeded, the system automatically terminates the MFA session. This dynamic response to changing conditions resolves the contradiction by making security adaptive rather than static.
Solution Approach 2:
The system continuously monitors proximity between devices and uses this feedback to control authentication flow. The proximity monitoring provides real-time feedback that triggers either continuation or termination of the MFA session. This feedback mechanism ensures that authentication convenience is maintained only when security conditions (proximity) are satisfied.
2Reliability
If continuous proximity monitoring is implemented using Bluetooth pairing information, then unauthorized access is prevented when user moves away, but additional security checks increase system complexity
Solution Approach 1:
The system leverages the existing Bluetooth pairing information that devices already maintain for their own operational purposes. Instead of implementing a separate complex monitoring system, the patent repurposes the Bluetooth proximity data that devices already exchange for connectivity. This self-service approach uses existing infrastructure to provide enhanced security without proportionally increasing system complexity.
Solution Approach 2:
The Bluetooth pairing information serves multiple functions: it enables device connectivity and simultaneously provides proximity monitoring for security purposes. By making the proximity monitoring system universal (using the same Bluetooth infrastructure already in place), the patent avoids adding dedicated complex hardware or protocols, thus limiting the increase in system complexity while maintaining continuous security monitoring.
3Reliability
If MFA authentication is required for every access attempt, then account security is improved, but authentication time and user effort increase
Solution Approach 1:
Instead of requiring continuous MFA authentication for every action, the system implements periodic proximity verification. The Bluetooth proximity check occurs periodically to verify the user is still present, allowing multiple operations to proceed without repeated full MFA cycles. This periodic verification maintains security while reducing authentication time and user effort compared to continuous MFA requirements.
Data Source
AI summary
Techniques for determining whether to send an MFA push notification are described. An indication of a request for a user account to access the application service via a primary device is received at an MFA service from an application service. Using a PAN protocol, determine whether the primary device and the secondary device are within a threshold proximity. When the primary device and the secondary device are within the threshold proximity, allows a push notification to be transmitted to the secondary device requesting authentication to grant access to the user account by the primary device, and when the primary device and the secondary device are not within the threshold, refrain from transmitting the push notification.