Digital Credential Authentication via Distributed Ledger and Proximity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for digital credentialing face challenges in securely managing and verifying credentials, particularly in preventing unauthorized access when a user leaves their device unattended, as adversarial users can exploit reused credentials.
Innovation Solution
A system utilizing a distributed ledger for secure credential storage and verification, where digital credentials are managed through a digital credential aware identity and access management service (DCIAMS), employing cryptographic techniques and smart contracts to ensure credential legitimacy, validity, and revocation, and using proximity authentication to require physical presence for access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If digital credentials are reused for multiple connections, then authentication efficiency is improved, but security deteriorates because adversarial users can exploit the credential when the authenticated user leaves their device unattended
Solution Approach 1:
The system performs preliminary actions by establishing a secure connection and obtaining a credential before the user leaves their device. The credential is designed with built-in expiration and revocation mechanisms that automatically invalidate it after use or when the user departs, preventing unauthorized reuse without requiring real-time monitoring
Solution Approach 2:
The credential system transitions from static credential reuse to dynamic credential management. Credentials have temporary validity periods and can be revoked by the authentication server, allowing the system to adapt security levels based on user presence and connection status, balancing efficiency with security
2Reliability
If credentials are invalidated after use to prevent unauthorized access, then security is improved, but authentication efficiency deteriorates because users cannot make new connections without reusing credentials
Solution Approach 1:
The system implements periodic credential validation where credentials are issued with defined validity periods and can be renewed. This allows multiple connections within the validity window while maintaining security through automatic expiration, eliminating the need for credential reuse and preventing unauthorized access after the period expires
3Reliability
If a system is designed to use credentials securely with automatic invalidation, then security is improved, but device complexity increases
Solution Approach 1:
The authentication server acts as an intermediary that manages credential issuance, validation, and revocation. This centralizes the complex logic of credential lifecycle management, keeping client devices simple while maintaining robust security through server-side control of credential validity and revocation status
Data Source
AI summary
A system for credential authentication includes an interface and a processor. The interface is configured to receive a request from an application for authorization to access. Access to the application is requested by a user using a user device. The processor is configured to provide an authentication request to the user device, receive a device credential, wherein the device credential is backed by data stored in a distributed ledger, determine a user identifier and an authentication device associated with the user based at least in part on the device credential, provide a proof request to the authentication device, receive a proof response, determine that the proof response is valid, generate a token, and provide the token to the application authorizing access for the user.