Centralized Authentication Provider for Multi-Device Transaction Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transaction authorization methods are inflexible and insecure, particularly in handling high-value or high-risk transactions, as they often rely on traditional username/password combinations and do not effectively manage multiple service providers and user devices, leading to vulnerabilities in authentication and increased burdens on service providers.
Innovation Solution
A centralized authentication provider system that registers user accounts and personal devices, uses cryptographic private keys for transaction-specific instructions, and requires multiple device confirmations for high-risk transactions, enhancing security through a web server and authentication applications on personal devices, with optional push notifications and varied security policies based on device types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional username/password authentication is used, then the authentication process is simple, but security is compromised especially for high-value transactions
Solution Approach 1:
The authentication system is segmented into multiple independent components: a centralized authentication provider, user terminals, and personal devices with authentication applications. Each component performs a specific function, and together they form a secure multi-factor authentication system that replaces the simple username/password model.
Solution Approach 2:
A centralized authentication provider acts as an intermediary between service providers and users. This intermediary manages authentication credentials, verifies user identities, and coordinates multi-device confirmations, thereby enhancing security without requiring service providers to implement complex authentication logic themselves.
2Adaptability or versatility
If multiple service providers are supported, then service coverage is improved, but authentication management becomes more complex
Solution Approach 1:
The centralized authentication provider is designed as a universal system that can serve multiple service providers simultaneously. It implements standardized authentication protocols and interfaces that work across different service providers, allowing one authentication system to fulfill multiple functions and support diverse services.
Solution Approach 2:
The authentication system enables users to self-register and self-manage their authentication credentials through user terminals and personal devices. Users can independently set up multi-device authentication, manage their devices, and control their security settings without requiring manual configuration by service providers, thereby reducing authentication management complexity.
3Reliability
If cryptographic private keys are used for transaction-specific instructions, then security is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The system replaces manual authentication operations (typing passwords, signing physical documents) with automated cryptographic operations. Authentication applications on personal devices automatically perform cryptographic signing of transaction-specific instructions using stored private keys, eliminating the need for users to manually handle cryptographic operations while maintaining high security.
Solution Approach 2:
The centralized authentication provider serves as an intermediary that manages cryptographic key pairs and handles the complexity of cryptographic operations. It generates private keys securely, stores them in protected memory, and automates the signing process, thereby shielding users from cryptographic complexity while ensuring secure transaction authentication.
4Reliability
If multi-device confirmation is required for high-risk transactions, then security against theft is improved, but transaction processing time increases
Solution Approach 1:
The system implements risk-based authentication where not all transactions require the same level of verification. For low-risk transactions, simpler authentication methods are sufficient, while only high-risk transactions trigger multi-device confirmation. This partial application of strict authentication measures reduces time loss for routine transactions while maintaining security for high-risk operations.
Solution Approach 2:
Users pre-register their personal devices and establish trust relationships before actual transactions occur. The authentication applications are pre-installed and configured, and device identities are pre-verified. This preliminary setup eliminates the need for time-consuming verification during actual transactions, as the system only needs to coordinate pre-established devices for high-risk transactions.
Data Source
AI summary
Authorizing transactions by an authentication provider involves at least one preparatory phase and an authorization phase. The preparatory phase includes registering a user account with several personal devices, each with an authentication application installed. The authorization phase receives knowledge of the transaction; determines the user account related to the transaction; determines at least one personal device registered with the user account related to the transaction; receives a request for details specific to the transaction from at least one personal device; provides the authentication application of the at least one personal device with the requested details specific to the transaction; receives from the authentication application a digitally signed transmission which indicates transaction-specific instructions received by the authentication application; and authorizes or denies the transaction based on the received transaction-specific instructions.