Dual-Device Authentication System for Secure Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for managing usernames and passwords, such as locally stored and online storage approaches, are vulnerable to theft and compromise, leading to potential unauthorized access and significant effort required to regain control over resources.
Innovation Solution
Implementing a dual-device system where a resource accessing device and an access control device, both in the user's possession, are used to authenticate and control access to protected resources, providing stronger security and convenience through challenge-response authentication and periodic re-authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If usernames and passwords are stored locally on the computerized device, then access convenience is improved, but security is worsened because a thief can steal the device and access all protected resources
Solution Approach 1:
The system divides access control into two separate segments: a resource accessing device for actually accessing protected resources and an access control device for authenticating the user. This segmentation ensures that possessing one device does not grant access to all resources, resolving the contradiction between convenience and security.
Solution Approach 2:
The access control device acts as an intermediary between the user and the protected resources. It mediates the authentication process by verifying the user's identity before allowing access, thereby maintaining security while enabling convenient access through the resource accessing device.
2Reliability
If usernames and passwords are stored on a third-party website, then security is improved, but the system becomes vulnerable to remote compromise where a thief can access resources from any device
Solution Approach 1:
The system segments authentication into two independent parts: the access control device stored on a third-party server and the resource accessing device used for actual access. This segmentation prevents remote compromise of the entire system, as compromising one device does not affect the other.
Solution Approach 2:
The system uses copies of authentication credentials distributed across multiple devices rather than storing all credentials in one place. The access control device contains authentication information while the resource accessing device contains resource access capabilities, creating a distributed copy system that resists compromise.
3Device complexity
If a single device is used for both accessing resources and controlling access, then device complexity is reduced, but the ability to terminate sessions and lock out unauthorized access is worsened
Solution Approach 1:
The system segments the devices into a resource accessing device and an access control device. This segmentation enables the access control device to independently manage authentication and session termination, providing enhanced security capabilities without significantly increasing overall system complexity.
Solution Approach 2:
The access control device serves as an intermediary that manages authentication and session control. It mediates between the user and the protected resources, enabling the system to terminate sessions and lock out unauthorized access while maintaining relative simplicity through clear functional separation.
Data Source
AI summary
A technique controls access to a protected resource residing on a protected resource server. The technique involves conveying, in response to a user request to access the protected resource residing on the protected resource server, a challenge from a resource accessing device to an access control device. The technique further involves transmitting an answer to the challenge from the access control device to the resource accessing device. The technique further involves completing an authentication operation based on the answer to the challenge. The resource accessing device obtains electronic access to the protected resource residing on the protected resource server when the authentication operation results in successful authentication. The resource accessing device does not obtain electronic access to the protected resource residing on the protected resource server when the authentication operation results in unsuccessful authentication.