Distributed Ledger Authentication for Secure Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security methods for accessing protected resources rely on centrally managed access credentials, which are prone to security breaches, and multifactor authentication that fails to prevent authorized users from downloading protected data to unauthorized devices.
Innovation Solution
A method that uses a distributed ledger to securely onboard devices and users, combining their MAC addresses and user IDs into an encrypted single entity, which is then validated through a random selection of workstation copies, ensuring secure access to protected resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centrally managed access credentials are used for authentication, then ease of operation is improved, but security reliability deteriorates due to centralized storage vulnerabilities
Solution Approach 1:
The patent extracts the credential verification function from centralized storage and distributes it across multiple workstations through the distributed ledger. Each workstation holds a copy of the credential data, eliminating the single point of failure while maintaining authentication functionality.
Solution Approach 2:
The centralized credential storage is segmented into distributed copies across multiple workstations. The authentication system divides the verification process among multiple nodes, with each workstation capable of independently verifying credentials against its local ledger copy.
2Reliability
If multifactor authentication is implemented, then security is improved, but authorized users can still access protected resources on unauthorized devices
Solution Approach 1:
The patent merges the user credential verification with device identification into a unified authentication process. The amalgamated credential contains both user identity and device identifier, ensuring that credentials are bound to specific devices and cannot be transferred to unauthorized devices.
Solution Approach 2:
The system performs preliminary binding of credentials to specific devices during the authentication process. By embedding device identifiers in the credential verification, the system preemptively prevents credential reuse on unauthorized devices before access can occur.
3Reliability
If distributed ledger with random workstation selection is used, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent uses copies of the distributed ledger stored on multiple workstations instead of a single centralized database. Each workstation maintains a copy of the credential data, enabling distributed verification without requiring complex centralized infrastructure.
Solution Approach 2:
The system dynamically selects which workstation will handle each authentication request from the network of available workstations. This dynamic load distribution simplifies individual workstation complexity while maintaining overall system security through distributed verification.
Data Source
AI summary
A server receives encrypted data from a protected-resource-requesting device that includes an encrypted combination of the device and user identification. The first server requests a most recent copy of data of a distributed ledger from a randomly selected logged-in workstation. The first server searches for a match of the encrypted data from the first device in the distributed ledger data received from the randomly selected workstation. In response to determining a match, the first server updates a table of a second server with a one-time-password (OTP) and a copy of the encrypted data received from the device. The first server sends the OTP and an instruction to the device to send the OTP and the encrypted data to the second server, which determines whether a match exists. In response to a confirmed match, the first server grants access to the device.