Dual-Phase Client User Authentication Mechanism

Solution Overview

Problem

Existing remote processing techniques fail to prevent unauthorized access to protected resources on portable computing devices, as they only authenticate clients and do not ensure that the user is authorized to access these resources.

Innovation Solution

An authentication mechanism that authenticates both clients and users by using a remote access server on the portable computing device, which verifies client credentials and requires user authentication through a separate interface before allowing access to protected resources, thereby preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If only client authentication is implemented, then client access is verified, but unauthorized users can still access protected resources through stolen portable computing devices

Engineering Contradiction:

Improveaccess securityVSAvoidauthentication mechanism

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication process is segmented into two distinct phases: client authentication (verifying the remote system's identity) and user authentication (verifying the authorized user's identity). This segmentation ensures that both components must be validated independently, preventing unauthorized access while maintaining manageable authentication complexity through structured separation of concerns.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary client authentication before allowing any access requests to reach the protected resources. By verifying the client's identity and credentials in advance, the system establishes a secure foundation before proceeding to user authentication, ensuring that only authenticated clients can initiate access attempts.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If dual authentication (client and user) is implemented, then unauthorized access is prevented, but authentication process complexity increases

Engineering Contradiction:

Improveaccess securityVSAvoidauthentication mechanism

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication process is segmented into two distinct phases: client authentication (verifying the remote system's identity) and user authentication (verifying the authorized user's identity). This segmentation ensures that both components must be validated independently, preventing unauthorized access while maintaining manageable authentication complexity through structured separation of concerns.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary client authentication before allowing any access requests to reach the protected resources. By verifying the client's identity and credentials in advance, the system establishes a secure foundation before proceeding to user authentication, ensuring that only authenticated clients can initiate access attempts.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If client authentication only is used, then remote clients can access resources, but the portable computing device cannot prevent tampering with protected resources

Engineering Contradiction:

Improveremote access capabilityVSAvoidresource tampering

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The authentication process is segmented into two distinct phases: client authentication (verifying the remote system's identity) and user authentication (verifying the authorized user's identity). This segmentation ensures that both components must be validated independently, preventing unauthorized access while maintaining manageable authentication complexity through structured separation of concerns.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The user authentication mechanism acts as an intermediary between the authenticated client and the protected resources. Even though the client is verified, the user authentication step serves as an additional mediator that must approve access requests, preventing tampering while preserving the remote access capability established by the client authentication layer.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8176533B1Complementary client and user authentication scheme

Publication Date: 2012.05.08 ORACLE AMERICAN INC

AI summary

An authentication mechanism is provided to authenticate both client and user of a portable computing device when the user causes a client to request a protected resource on the portable computing device. Upon receiving a request a protected resource by the client, the authentication mechanism determines which authentication method is specified for authentication of the client, and authenticates the client accordingly. Upon a determination that the client is authentic, the authentication mechanism invokes a user interface that is separate and distinct from the client to solicit input from the user. Based on the input solicited from the user, the authentication mechanism determines whether the user is an authentic user of the portable computing device. If it is determined that the user is an authentic user, the authentication mechanism determines based on an indication from the user whether the client should be authorized to access the protected resource requested.