Conditional Secondary Authentication via Trustworthiness Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively prevent unauthorized access to validated user sessions, as attackers can use techniques like session hijacking or impersonate users with stolen or counterfeit data, posing a security risk.
Innovation Solution
Implementing secondary authentication methods, such as biometric or one-time password authentication, based on a calculated trustworthiness score derived from parameters like homomorphic hash values, geo-location data, and device information, to verify the legitimacy of user requests before allowing access to files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secondary authentication is performed for every file access request, then security against unauthorized access and session hijacking is improved, but user experience degradation and processing time increase
Solution Approach 1:
The system dynamically changes the authentication parameter from always requiring secondary authentication to conditionally requiring it based on trustworthiness score thresholds. When the score exceeds the threshold, only primary authentication is required; when it falls below, secondary authentication is triggered, thus adapting the security level to the assessed risk.
Solution Approach 2:
The authentication requirement transitions from a static always-on approach to a dynamic conditional approach. The system continuously assesses trustworthiness scores and adjusts whether secondary authentication is needed in real-time, making the security mechanism flexible and responsive to changing conditions.
2Reliability
If secondary authentication is always required, then protection against session hijacking and impersonation is improved, but ease of operation deteriorates
Solution Approach 1:
The system changes the operational parameter of authentication requirement from fixed (always required) to variable (conditionally required based on trustworthiness score). This allows the system to maintain high security when needed while providing seamless operation when the user is trusted.
Solution Approach 2:
The system performs self-assessment of trustworthiness using multiple parameters (device information, location data, behavior patterns) and automatically determines whether secondary authentication is needed, eliminating the need for manual security decisions and reducing user burden.
3Measurement precision
If multiple authentication parameters are collected and analyzed, then measurement precision of trustworthiness assessment is improved, but device complexity increases
Solution Approach 1:
The trustworthiness assessment system is segmented into multiple independent parameter collection modules (device information, location data, behavior patterns) that can be independently implemented and maintained. Each module contributes to the overall assessment without requiring complex integration, managing system complexity through modular design.
Solution Approach 2:
The system uses multiple parameters that serve universal purposes - device information, location data, and behavior patterns are not just for authentication but also for user profiling, security monitoring, and service optimization, making the collected data multi-functional and reducing the need for separate data collection systems.
Data Source
AI summary
Described embodiments provide systems and methods for validating a request to perform an action to access at least one file. A computing device can receive a request from the client, the request being to perform an action to access at least one file and including a first computed value indicative of one or more previous actions on files. The computing device may compare the first computed value to a second computed value maintained by the computing device independently from the first computed value. The second computed value may be indicative of the one or more previous actions on the files. The computing device may perform secondary authentication in addition to primary authentication for the client, responsive to an indication of trustworthiness of the client or the file according to the comparison of the first computed value to the second computed value.