Companion Device Authentication Without Smartphone Unlocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods require users to locate and unlock their smartphones to interact with authentication applications, which can be inconvenient when the smartphone is not easily accessible, and they do not provide secure password-less or multi-factor authentication without exposing sensitive credentials to potential interception.
Innovation Solution
Utilizing a companion device, such as a smartwatch, connected to a smartphone to perform user authentication processes wirelessly, allowing interaction with authentication services without unlocking the smartphone, and ensuring that sensitive credentials are never transmitted between devices, using secure memory to store and manage authentication keys and codes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a smartphone application is used for user authentication, then authentication can be performed, but the user must locate and unlock the smartphone which reduces convenience
Solution Approach 1:
The authentication system is segmented into multiple components: the primary computing device, the mobile computing device, and the companion device. Each device performs specific authentication functions, allowing the user to authenticate without needing to unlock the smartphone. The companion device handles credential verification while the smartphone remains locked, improving convenience while maintaining security.
Solution Approach 2:
The companion device acts as an intermediary between the user and the authentication system. It receives authentication requests from the primary computing device, verifies credentials using secure elements, and communicates approval/disapproval to the primary device. This intermediary role eliminates the need for the user to directly interact with the locked smartphone, enhancing convenience while preserving security through the companion device's secure credential storage.
2Ease of operation
If credentials are transmitted between devices for authentication, then authentication can be performed, but sensitive credentials may be intercepted which reduces security
Solution Approach 1:
The sensitive credentials (private keys, authentication secrets) are extracted from the transmission path and stored exclusively in the secure element of the companion device. The companion device uses these credentials locally to verify authentication requests without transmitting them to the primary computing device or server. This extraction of credentials from the communication channel eliminates interception risks while maintaining authentication functionality.
Solution Approach 2:
The system changes the parameter of credential transmission by implementing asymmetric cryptography. Instead of transmitting sensitive private keys, the system transmits public keys and cryptographic signatures. The companion device signs authentication tokens with its private key (never transmitted), and the server verifies these signatures using the public key. This parameter change from direct credential transmission to cryptographic proof transmission maintains security while enabling remote authentication.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
User authentication techniques that use a companion device associated with a mobile computing device are described. The companion device receives a user authentication request from a user authentication service via the mobile computing device, displays information related to the user authentication request, receives an approval of the user authentication request, and transmits the approval of the user authentication request to the service via the mobile computing device. In one embodiment, after transmitting the approval, the companion device receives a token from the mobile computing device that includes a value obtained from the service, signs the token with a private key of a securely-stored signing key pair and provides the signed token to the service via the mobile computing device. In another embodiment, after the companion device transmits the approval to the mobile computing device, the mobile computing device provides a personal identification code from secure storage to the service.