Dynamic Authentication Chain for Adaptive MFA
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems rely on pre-determined or pre-configured authentication schemes, which can be tedious for administrators to manage and do not dynamically adapt to changing user behavior or resource security levels, often relying solely on client-side data for multi-factor authentication.
Innovation Solution
A method that generates a dynamic authentication chain comprising a plurality of authentication schemes arranged in a particular order based on server-side parameters such as user history, role-specific access, and privilege control, allowing for intelligent and adaptive selection of authentication schemes to ensure the appropriate level of security for resource access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If pre-configured authentication schemes are used, then device complexity is reduced, but adaptability deteriorates
Solution Approach 1:
The authentication system dynamically generates authentication chains at runtime based on real-time risk assessment of user requests. Instead of using static pre-configured schemes, the system adapts the authentication requirements dynamically by evaluating factors such as user behavior patterns, resource sensitivity, and request characteristics, thereby achieving adaptability without requiring complex manual configuration for each scenario.
Solution Approach 2:
The system changes authentication parameters dynamically by adjusting the composition and order of authentication schemes in the chain based on risk scores. The authentication requirements are modified in real-time by changing which authentication methods are required and in what sequence, allowing the system to adapt to different risk levels without increasing overall device complexity.
2Reliability
If client-side data is used for risk calculation, then ease of operation is improved, but reliability deteriorates
Solution Approach 1:
The system introduces a server-side risk assessment service as an intermediary between the client and authentication decision-making. Instead of relying directly on client-side data, the server acts as a trusted mediator that collects, validates, and analyzes risk factors from multiple sources including user behavior patterns and resource characteristics, thereby improving reliability while maintaining ease of operation through automated server-side processing.
3Adaptability or versatility
If fixed authentication schemes are used, then device complexity is reduced, but adaptability to changing conditions deteriorates
Solution Approach 1:
The authentication system transitions from static fixed schemes to dynamic generation of authentication chains. The system adaptively constructs authentication requirements by selecting and ordering multiple authentication schemes based on real-time risk assessment, enabling the system to respond to changing conditions such as user behavior anomalies or resource sensitivity changes without requiring complex manual reconfiguration.
Solution Approach 2:
The authentication process is segmented into multiple independent schemes that can be dynamically selected and ordered. Instead of using a single fixed authentication method, the system divides authentication into multiple schemes (e.g., password verification, multi-factor authentication, device verification) and dynamically assembles them into chains based on risk levels, providing adaptability while keeping individual components manageable.
Data Source
AI summary
A method of dynamic adaptive authentication includes receiving a request from a user to access a resource of a network and determining whether the resource is protected. In response to determining that the resource is protected, a dynamic authentication chain is generated. The dynamic authentication chain includes a plurality of authentication schemes that are arranged in a particular order. The method also includes challenging the user with the dynamic authentication chain and receiving a set of credentials from the user based at least in part on the particular order of the dynamic authentication chain. The method includes determining whether the set of credentials satisfies the dynamic authentication chain. In response to determining that the set of credentials satisfies the dynamic authentication chain, the user is authenticated.