Centralized Authentication Service for Mobile Biometric Security
Solution Overview
Problem
Existing methods for biometric authentication in mobile terminals are limited to local applications and require significant setup between applications and terminals, making them economically unviable and insecure for external applications.
Innovation Solution
A method and system where an authentication service acts as an intermediary, using existing authentication interfaces and protocols to facilitate biometric authentication by transmitting a query to a mobile terminal, which inputs a biometric security feature to sign a transaction identifier, and verifies the signature, allowing external applications to trust the authentication service without direct terminal interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biometric authentication is implemented locally in mobile terminals for external applications, then authentication security is improved, but device complexity and setup costs increase significantly
Solution Approach 1:
The patent introduces an authentication service as an intermediary between external applications and mobile terminals. This service acts as a mediator that handles biometric authentication centrally, eliminating the need for applications to directly integrate with terminal biometric readers. The intermediary abstracts the complexity of biometric operations, allowing applications to authenticate users without managing the actual biometric processing infrastructure.
Solution Approach 2:
The biometric authentication functionality is extracted from individual applications and relocated to a centralized authentication service. This extraction allows applications to rely on the service for authentication rather than implementing their own biometric handling, significantly reducing per-application complexity and setup costs while maintaining security through centralized management.
2Speed
If applications directly access biometric readers in mobile terminals, then authentication speed is improved, but security risks increase due to lack of trust establishment
Solution Approach 1:
The authentication service serves as a trusted intermediary that establishes secure communication with mobile terminals. Applications interact with this intermediary rather than directly accessing terminal biometric readers, creating a layered trust architecture. The service handles authentication requests through secure protocols, ensuring that applications do not need to establish direct trust relationships with terminals while maintaining fast authentication speeds.
3Adaptability or versatility
If applications relocate to mobile terminals to enable biometric authentication, then authentication capability is improved, but economic viability decreases due to high development costs
Solution Approach 1:
The authentication service provides a universal authentication capability that serves multiple applications simultaneously. Rather than requiring each application to independently integrate biometric authentication, the service offers a common interface that applications can use without modification. This multi-functional approach enables authentication capability across diverse applications while significantly reducing individual development costs.
Solution Approach 2:
By introducing the authentication service as an intermediary layer, applications gain biometric authentication capability without needing to relocate or modify their core functionality. The service handles all biometric operations centrally, allowing applications to maintain their original design while gaining enhanced authentication capability through the service interface.
4Ease of operation
If centralized authentication services are used for external applications, then ease of connection is improved, but authentication transparency decreases as terminal address must be known to application
Solution Approach 1:
The authentication service acts as an intermediary that masks the underlying terminal address details from applications. Applications interact with the service through standardized interfaces without needing to know or detect the specific terminal addresses involved in authentication. The service handles address resolution and communication routing transparently, maintaining ease of connection while preserving authentication transparency.
Data Source
AI summary
The invention relates to a method and system for authenticating a user, wherein an application transmits a query comprising identification data to an authentication service, the authentication service determines the address of a mobile terminal linked to the user on the basis of the identification data and transmits a request comprising a transaction identifier to the mobile terminal, the mobile terminal performs an enquiry for input of a biometric security feature, grants access to a private key saved on the mobile terminal upon input of a valid security feature, signs the transaction identifier using the private key and transmits the signed transaction identifier back to the authentication service, and the authentication service verifies the signature of the signed transaction identifier and, in the case of the presence of an authentic signature, transmits a confirmation of the query back to the application.