Cloud MFA Key Isolation for Secure OTP Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multifactor authentication (MFA) systems in large organizations face inefficiencies and security risks due to the need for each user device to store a secret key, leading to potential exposure and unauthorized access, especially when third parties are involved.
Innovation Solution
Implementing a cloud-based MFA service within a tenancy of a cloud services provider, where the MFA service generates one-time pads (OTPs) using secret keys stored in a multitenant database, ensuring the secret keys remain under organizational control and are not stored on user devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If each user device stores a secret key for MFA, then MFA can be implemented locally on devices, but security is worsened due to potential key exposure and unauthorized access
Solution Approach 1:
The patent extracts the secret key storage function from user devices and relocates it to a centralized cloud-based MFA service. The MFA service instances stored in cloud tenancies hold the secret keys, while user devices only receive and verify OTPs without ever storing the underlying secret keys. This extraction eliminates the security risks associated with key exposure on user devices while maintaining local MFA functionality through cloud-generated OTPs.
2Ease of operation
If secret keys are stored on user devices, then MFA operation is simplified on-device, but device complexity increases due to key management requirements
Solution Approach 1:
The patent introduces a cloud-based MFA service as an intermediary between authentication authorities and user devices. This intermediary handles all complex key management operations including secret key generation, storage, and distribution. User devices interact with the MFA service through simple OTP verification interfaces without needing to manage secret keys themselves. The intermediary absorbs the complexity of cryptographic key management while providing simplified on-device MFA operation through received OTPs.
3Adaptability or versatility
If third parties are involved in MFA implementation, then system versatility improves, but security is worsened due to potential key exposure
Solution Approach 1:
The patent segments the MFA system into isolated cloud-based MFA service instances, each operating within its own cloud tenancy boundary. Each MFA service instance manages its own secret keys independently within its designated tenancy, creating security isolation between different third-party systems. This segmentation allows multiple third parties to integrate with the cloud MFA service through standardized interfaces while maintaining security through tenancy isolation - each party gets access to its own keys without exposing other parties' keys. The segmentation enables system versatility through multi-tenancy support while preserving security through isolated key management.
Data Source
AI summary
A method may include receiving, by a multifactor authentication (MFA) service instantiated on a computing system, a token generated by a cloud services provider and associated with a user device. The MFA service may be instantiated within a tenancy of the cloud services provider. The method may include determining, by the computing system, an authorized cloud service instantiated within the tenancy. The method may include receiving, by the computing system, a request to access the authorized cloud service by the user device, where the request may include a multi-factor authentication request. The method may include generating, by the MFA service instantiated on the computing system, a one-time pad (OTP). The method may include providing, by the MFA service instantiated on the computing system, the OTP to the user device such that the user device accesses the authorized cloud service.