Cryptographic Device Binding for Repeated Token Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current token provisioning processes require multiple step-up authentications for each token requestor, leading to inefficiencies in resource consumption and time, particularly when users interact with multiple token requestors.
Innovation Solution
A method involving device binding and cryptographic key pairs is implemented, where a user device is designated as 'trusted' and bound to credentials, allowing tokens to be associated with the device identifier, reducing the need for repeated user authentication by using the public key to validate previous ownership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple step-up authentication processes are performed for each token requestor, then authentication security is improved, but system efficiency deteriorates due to redundant authentication steps
Solution Approach 1:
The system performs preliminary device binding and authentication during the initial token provisioning process. By binding the user device identifier to the credential and storing the public key beforehand, the system prepares authentication data in advance so that subsequent token requests from the same device do not require repeated step-up authentication, thereby improving efficiency while maintaining security
Solution Approach 2:
The patent introduces a token service computer as an intermediary that manages the binding between user devices and credentials. This intermediary stores mappings between user device identifiers and credentials, and verifies authentication using stored public keys, eliminating the need for repeated direct authentication steps with multiple token requestors
2Productivity
If device binding is implemented to reduce authentication requests, then system efficiency is improved, but authentication complexity increases due to additional binding processes
Solution Approach 1:
The patent merges multiple authentication functions into a single device binding process. Instead of handling authentication separately for each token requestor, the system combines device identification, credential binding, and public key verification into one unified process that occurs during initial token provisioning, thereby reducing overall system complexity
3Reliability
If step-up authentication is required for each token requestor, then credential security is improved, but time consumption increases
Solution Approach 1:
The system performs preliminary authentication and device binding during the initial token provisioning process. By completing authentication steps upfront and storing the results, the system eliminates repeated time-consuming authentication steps for subsequent token requests from the same device, significantly reducing time consumption while maintaining credential security through the stored binding information
Data Source
AI summary
A method is disclosed. The method includes receiving, from a user device storing a private key of a public-private key pair, a first attestation message comprising a first attestation data packet, the public key, a user device identifier for the user device, and a credential. The method also includes binding the credential to the user device identifier, and transmitting, to a token service computer, the first attestation data packet. The token service computer previously bound a first token from a first token requestor interacting with the user device to the user device identifier. The method includes receiving, from a second token requestor interacting with the user device, a second attestation message comprising a second attestation data packet, verifying, the second attestation data packet using the public key, and transmitting, verification data to the second token requestor. The second token requestor transmits the verification data to the token service computer.