Dynamic Application Authentication Using Behavioral Fuzzy Vaults
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application and device authentication methods using credentials are vulnerable to attacks and require secure storage, which can lead to credential leaks and single points of failure.
Innovation Solution
Implement a fuzzy vault system that locks authentication keys with behavioral data, using sensors to monitor application or device behavior and securely store the key in a fuzzy vault, allowing retrieval and validation through behavioral data comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized credential storage is used, then authentication can be performed, but the system becomes a single point of failure and susceptible to attacks
Solution Approach 1:
The credential authentication system is segmented into distributed components: each client device stores its own credentials locally rather than in a centralized repository. The authentication process is divided into credential presentation by the client and verification by the server, eliminating the single point of failure while maintaining authentication functionality.
Solution Approach 2:
The vulnerable centralized credential storage is extracted and replaced with local credential storage on client devices. The server extracts only the verification function, not the credential storage, thereby removing the single point of failure while preserving authentication capability.
2Reliability
If client applications store credentials securely, then authentication can be performed, but the system becomes vulnerable to attacks on clients
Solution Approach 1:
Instead of the server storing and managing credentials (which creates centralized vulnerability), the inversion places credential storage and management on the client side. The client presents credentials to the server for verification, reversing the traditional model and making the system resilient to server-side compromises while maintaining authentication functionality.
Solution Approach 2:
The authentication server acts as an intermediary that verifies credentials without storing them. It mediates between the client's credential presentation and the authentication decision, eliminating the need for the server to handle sensitive credential data while preserving authentication capability.
3Reliability
If centralized credential management is implemented, then authentication can be performed, but credential leaks can occur when compromised
Solution Approach 1:
Credential management is segmented and distributed to individual client devices rather than centralized. Each client independently manages its own credentials, so a compromise of one client does not expose credentials of other clients, preventing credential leakage while maintaining authentication service availability.
Solution Approach 2:
The credential storage function is extracted from the centralized server and placed locally on client devices. The server retains only the verification function, thereby eliminating the risk of credential leakage from server compromises while preserving the authentication service.
Data Source
AI summary
An application or device is authenticated using secure application data validation. A server computer receives an authentication request comprising an application identifier or a user device identifier associated with a user device, the authentication request originating from the user device. The server computer receives a set of behavioral data associated with the application or the user device. Responsive to receiving the application identifier or device identifier, the server computer obtains a fuzzy vault associated with the application identifier or the user device identifier. The server computer determines a reconstructed key value using the fuzzy vault and the set of behavioral data. The application or the user device is authenticated using the reconstructed key value.