Bootstrap Device Provisioning via Vouching Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face cumbersome multi-factor authentication processes when accessing various online accounts across different devices, requiring repetitive authentication for each device and account combination, which can be inconvenient and time-consuming.
Innovation Solution
A bootstrap provisioning system that automatically provisions a target device to access an account by using a vouching device already authorized to access the account, generating and certifying authentication data, and notifying the account provider to verify the target device's authorization, thereby streamlining the authentication process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication is required for each device and account combination, then security level is improved, but user convenience and authentication speed deteriorate
Solution Approach 1:
The system performs preliminary provisioning of devices to account providers before actual authentication is needed. Device public keys are stored and associated with user accounts in advance, so when authentication is required, the system can quickly retrieve and verify the pre-stored public key without requiring real-time multi-factor authentication steps.
Solution Approach 2:
The system creates a copy of the authentication mechanism by storing the device's public key (rather than requiring the private key or complex authentication factors) at the account provider. This public key copy serves as a persistent identifier that enables fast authentication while maintaining security, as the private key never leaves the secure cryptoprocessor.
2Reliability
If multi-factor authentication is performed for each device and account combination, then security level is improved, but authentication time and complexity increase
Solution Approach 1:
The system performs preliminary provisioning of devices to account providers before actual authentication is needed. Device public keys are stored and associated with user accounts in advance, so when authentication is required, the system can quickly retrieve and verify the pre-stored public key without requiring real-time multi-factor authentication steps.
Solution Approach 2:
The system extracts the authentication verification step from the real-time authentication process. By storing the device's public key at the account provider during provisioning, the verification process is separated from the login process, allowing for faster authentication since the public key is already available for immediate verification.
3Ease of operation
If persistent cookies are used for device provisioning, then ease of logon is improved, but security level deteriorates
Solution Approach 1:
The system replaces the mechanical cookie-based provisioning mechanism with a cryptographic key-based mechanism. Instead of relying on persistent cookies that can be stolen or manipulated, the system uses asymmetric cryptography where the device generates a public/private key pair, and the public key is stored at the account provider. This substitution maintains ease of logon while significantly improving security.
Solution Approach 2:
The system changes the fundamental parameter of device identification from cookies (which are susceptible to security issues) to cryptographic public keys (which provide both security and ease of use). This parameter change transforms the provisioning mechanism from a less secure cookie-based system to a more secure key-based system that maintains user convenience.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for bootstrap provisioning of a device is provided. A vouching device is provisioned to access a bootstrap account of a bootstrap account provider and a secondary account of a secondary account provider. The bootstrap account provider stores an indication of the secondary account, and the secondary account provider stores verification data to verify a certification of the vouching device. A target device is provisioned to access the bootstrap account of the bootstrap account provider. The target device receives from the bootstrap account provider an indication that the target device is provisioned with the secondary account provider. The target device directs generation of a certification by the vouching device of target authentication data of the target device. The target device then sends the certification to the secondary account provider to effect the provisioning of the target device to access the secondary account.