Decentralized Identity Verification With Token-Based Zero-Trust Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity authentication methods rely on users storing secrets on their devices or third-party servers, making them vulnerable to theft and compromise, and existing passwordless methods like FIDO fail to effectively prevent unauthorized access.
Innovation Solution
A decentralized zero-trust identity verification system that generates unique digital tokens based on user-specific features, using a public but untamperable digital ledger to store answer data, ensuring that user features cannot be reverse-engineered, and employs multi-party computation to secure authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secrets (fingerprint, face image, password) are stored in the bank host for authentication, then authentication can be performed, but the bank bears the burden of keeping secrets and risks financial or credit losses if stolen
Solution Approach 1:
The patent extracts the secret from the bank host and places it in the user's device. The user's device stores the secret (fingerprint, face image, or password) and uses it to generate authentication tokens locally, eliminating the need for the bank to store or manage these secrets. This resolves the contradiction by maintaining authentication reliability while removing the secret management burden from the bank.
Solution Approach 2:
The patent introduces an intermediary authentication token that mediates between the user's secret and the bank's verification system. Instead of directly using the secret, the user's device generates a token based on the secret and sends it to the bank for verification. This intermediary mechanism maintains security while simplifying the authentication process and eliminating the need for the bank to store secrets.
2Ease of operation
If passwordless authentication methods (FIDO) are used with secrets stored in user devices, then authentication responsibility shifts to users, but users bear the risks when devices are cracked or private keys are stolen
Solution Approach 1:
The patent introduces an intermediary authentication token that mediates between the user's secret and the bank's verification system. The token is generated locally in the user's device using the secret, but the actual verification is performed by the bank using their own stored data. This maintains authentication convenience while shifting security risk back to the bank, as they retain control over the verification process and their own secret storage.
Solution Approach 2:
The patent inverts the traditional authentication model by having the bank store verification data instead of authentication secrets, and having the user's device generate tokens instead of directly presenting secrets. This inversion maintains ease of operation while improving reliability, as the bank's system becomes the secure anchor point rather than the user's device.
3Productivity
If user biometric features are stored in user devices or third-party authentication agencies, then authentication can be performed, but once cracked all applications will be compromised
Solution Approach 1:
The patent segments the authentication system into two independent parts: the user's device stores the biometric secret and generates tokens, while the bank stores verification data independently. Neither party stores complete authentication information, creating segmented security zones. This resolves the contradiction by maintaining authentication efficiency while reducing data breach risk, as compromising one segment does not compromise the entire system.
Solution Approach 2:
The patent introduces an intermediary authentication token that prevents direct exposure of biometric features. The token serves as a mediator that proves identity without revealing the underlying biometric data. This maintains authentication efficiency while protecting reliability, as the biometric features never leave the user's device and are never stored by the bank.
Data Source
AI summary
An identity verification-authentication system and method are used for verifying and authenticating at least a first user. The system includes a first prover for acquiring a first unique feature provided by the first user; and a verifier in communication with the first prover for generating a first proof request. The verifier sends a first variant data included in the first proof request to the first prover. The first prover generates a first to-be-compared answer data according to the first unique feature and the first variant data. The first prover or the verifier then generates a determination result according to a comparison of the first to-be-compared answer data and a first answer data included in the first proof request, and determines whether the identity verification and authentication of the first user is successfully according to the determination result.