Consensus-Based Online Authentication via Multi-Party Computation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional online authentication methods are vulnerable to fraudulent activities and inconvenient for users, as they often require multiple pieces of information and can be compromised if devices are hacked or stolen, lacking a comprehensive security assessment of both users and devices.
Innovation Solution
A consensus-based online authentication system where an encryption device requests a security assessment from support devices, which participate in a multi-party computation to generate an authentication cryptogram, ensuring the device's security state is verified before allowing access, using secret shares and cryptographic values to enhance security and convenience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, two-factor authentication) are used, then authentication security is improved, but the system becomes vulnerable to device hacking and theft
Solution Approach 1:
The authentication system is segmented into multiple independent components: the encryption device holds encryption keys, support devices store secret shares, and the server performs verification. This segmentation ensures that compromising one device (e.g., the encryption device) does not compromise the entire authentication system, as the secret shares distributed to support devices remain secure.
Solution Approach 2:
The server acts as an intermediary that receives the authentication cryptogram from the encryption device, verifies it using secret shares from support devices, and determines authentication success. This intermediary verification mechanism prevents direct trust in any single device, including the encryption device, thereby mitigating device hacking vulnerabilities.
2Reliability
If advanced authentication methods (two-factor authentication) are used, then authentication security is improved, but user convenience deteriorates
Solution Approach 1:
The encryption device automatically generates and transmits authentication cryptograms to the server without requiring user intervention. The support devices autonomously provide secret shares based on their security assessments. This self-service mechanism eliminates the need for users to manually provide multiple factors of authentication, significantly improving user convenience while maintaining security.
Solution Approach 2:
The system performs preliminary security assessments of both the encryption device and support devices before authentication occurs. By pre-evaluating device security states and distributing secret shares in advance, the system enables fast, automatic authentication without requiring users to go through complex multi-step verification processes during actual login attempts.
3Reliability
If security assessment of devices is performed, then fraudulent access is reduced, but system complexity increases
Solution Approach 1:
The support devices serve multiple functions: they store secret shares, perform security assessments of the encryption device, and provide authentication support. This multi-functionality consolidates what would otherwise require separate complex systems into unified devices, reducing overall system complexity while maintaining comprehensive fraud prevention capabilities.
Solution Approach 2:
The system implements feedback loops where support devices continuously assess the security state of the encryption device and adjust their participation in authentication accordingly. This feedback mechanism enables dynamic security assessment without requiring complex manual configuration, as the system automatically adapts to changing security conditions.
4Reliability
If multi-party computation is used for authentication, then authentication security is improved, but computation time increases
Solution Approach 1:
The system uses partial action by requiring only a threshold number of support devices to participate in the multi-party computation, rather than all support devices. This partial participation approach maintains sufficient security through the distributed secret shares while significantly reducing the computational time required for authentication compared to requiring all devices to participate.
Data Source
AI summary
Methods and systems for consensus-based online authentication are provided. An encryption device may be authenticated based on an authentication cryptogram generated by the encryption device. The encryption device may transmit a request for security assessment to one or more support devices. The support devices may individually assess the encryption device, other security devices, and contextual information. The support devices may choose to participate in a multi-party computation with the encryption device based on the security assessments. Support devices that choose to participate may transmit one or more secret shares or partial computations to the encryption device. The encryption device may use the secret shares or partial computations to generate an authentication cryptogram. The authentication cryptogram may be transmitted to a decryption device, which may decrypt the authentication cryptogram, evaluate its contents, and authenticate the encryption device based on its contents.