Distributed MFA Key Sharing With Approval-Based TOTP Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication systems lack a secure mechanism for distributing and managing TOTP secret keys among multiple authorized users, leading to security risks and non-compliance with organizational policies, especially in scenarios where access needs to alternate among a team of users across enterprises.
Innovation Solution
A system for multi-factor authentication workflow management that includes a MFA workflow management server to securely distribute and manage TOTP secret keys, enabling single or multiple user access with optional approval workflows, using public-private key encryption and secure storage to ensure only authorized users can access the keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If copies of the authentication secret key are locally stored or made accessible to multiple devices, then distributed access is enabled, but security is compromised because the secret key can be easily accessed by unauthorized parties
Solution Approach 1:
The patent segments the TOTP secret key into multiple shares using Shamir's Secret Sharing scheme. Instead of storing the complete secret key on multiple devices (which creates security risks), the system divides the key into N shares distributed across different devices. Any M shares (where M < N) are required to reconstruct the original key, enabling distributed access while maintaining security through cryptographic segmentation.
Solution Approach 2:
The patent introduces a cloud-based authentication service as an intermediary between users and the TOTP secret key. This intermediary manages the secret key shares and coordinates the reconstruction process. When a user needs access, the system retrieves appropriate shares from distributed storage, reconstructs the key through cryptographic computation, and provides the TOTP code - all without exposing the original secret key to any single device or user.
2Object-affected harmful factors
If the TOTP secret key is stored securely in a centralized system, then security is improved, but access flexibility for multiple users is reduced
Solution Approach 1:
The patent applies Shamir's Secret Sharing to divide the TOTP secret key into multiple shares that can be distributed to different users. Each user receives a specific share (or set of shares) that enables them to access the key when needed. This segmentation allows centralized security management while providing flexible distributed access - users can access the key from their personal devices without compromising overall system security.
Solution Approach 2:
The patent implements dynamic key reconstruction where the system can adaptively retrieve different combinations of shares based on real-time access requests. When a user needs access, the system dynamically determines which shares are required and retrieves them from appropriate storage locations. This dynamic approach enables flexible access control and user-specific permissions while maintaining secure centralized management of the original secret key.
3Object-affected harmful factors
If approval workflows are implemented for sensitive accounts, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-configuring approval workflows and authorization policies before access is needed. When a user requests access to a sensitive account, the system checks pre-established approval criteria and automatically retrieves the necessary shares if the user is authorized. This preliminary setup enables strong security through approval workflows while minimizing runtime complexity - the heavy cryptographic operations and policy evaluations are performed in advance or through simple lookup operations during access requests.
Data Source
AI summary
Multi-factor authentication workflow management with distributed access is disclosed, including: receiving, from a device, a request to complete a multi-factor authentication (MFA) process for an account at a source service platform; verifying, based at least in part on a security policy, that a user associated with the request is included in a set of authorized users that is permitted to access an encrypted secret key corresponding to the account at the source service platform; determining that a received key share included in the request can be combined with a stored key share to decrypt the encrypted secret key; and causing a passcode corresponding to the MFA process for the account at the source service platform to be generated for the device based at least in part on the decrypted secret key.