Client Authentication Token for BYOD Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for accessing remote computer resources are either costly and restrictive, such as Mobile Device Management (MDM), or less secure, like browser fingerprinting, which limits 'bring your own device' (BYOD) flexibility and robustness.
Innovation Solution
A method that authenticates an internet access client independently of user authentication, using a client certificate and authentication token to verify the client's identity, allowing secure access to remote resources without requiring enterprise-managed devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MDM (Mobile Device Management) is used to manage authentication, then security is improved and access control is robust, but device flexibility is reduced and deployment cost increases
Solution Approach 1:
The authentication process is segmented into two independent phases: device authentication (first authentication) and user authentication (second authentication). The device certificate authenticates the internet access client independently, while the user certificate authenticates the individual user. This segmentation allows enterprises to authenticate users without requiring full MDM control over their devices, thereby improving device flexibility while maintaining security.
Solution Approach 2:
A server acts as an intermediary that receives both the device certificate and user certificate, verifies them independently, and grants access permissions. This intermediary approach allows the system to enforce security policies without requiring direct MDM control over user devices, resolving the contradiction between security requirements and device flexibility.
2Reliability
If PKI (Public Key Infrastructure) with certificates is used for robust authentication, then security is improved, but deployment complexity and difficulty increase
Solution Approach 1:
The complex PKI authentication process is segmented into two simpler, independent certificate verifications: device certificate verification and user certificate verification. This segmentation simplifies deployment by allowing enterprises to issue certificates through standard processes without requiring complex PKI infrastructure setup, while still maintaining robust security.
Solution Approach 2:
The authentication system accepts standard certificates that can be obtained through various means (enterprise-issued, personal, or obtained from certificate authorities), making the solution universal and applicable across different devices and users without requiring custom PKI infrastructure, thereby reducing deployment complexity.
3Adaptability or versatility
If browser fingerprinting is used for authentication, then device flexibility is improved, but security robustness decreases
Solution Approach 1:
Instead of relying on fragile browser fingerprinting, the system uses digital certificates as a more reliable copy of identity verification. The device certificate copies the device's identity in a verifiable, secure manner, while the user certificate copies the user's identity, providing both flexibility and security that fingerprinting cannot achieve.
4Reliability
If multiple certificates are required for different devices, then security is improved, but ease of operation decreases
Solution Approach 1:
The device certificate and user certificate are merged into a single authentication flow where both are required together for access. This combining approach maintains security by verifying both device and user identity, while simplifying operation by allowing users to access multiple devices with a single user certificate paired with each device's certificate, rather than managing separate credentials for each device.
Data Source
AI summary
The invention relates to a device and a method for authenticating a user utilizing an internet access client (10) for accessing remote resources of a computer infrastructure, said access comprising a first authentication (130) of the internet access client (10) and a second authentication (140) of the user of the internet access client (10). The method includes sending (132), to a token security module (21), by the internet access client (10), a client certificate (220), said client certificate (220) being associated with items of identification information of the internet access client (10); and receiving (133), by the internet access client (10), an authentication token (210) generated by the token security module when the client certificate (220) sent has been verified by the token security module.