Dynamic Multi-Attribute Authentication Binding User and Workstation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication schemes in communication networks are vulnerable to security breaches despite multi-factor authentication, as they may exploit weaknesses to gain unauthorized access.
Innovation Solution
A dynamic, multi-attribute authentication system that verifies both the user and workstation by using workstation and user certificates, along with additional attributes like workstation name and biometric data, to ensure secure access to network resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional multi-factor authentication schemes are used, then user identity verification is provided, but the system remains vulnerable to security breaches and unauthorized access
Solution Approach 1:
The authentication system is segmented into multiple independent verification components: workstation certificate validation, user certificate validation, signature verification, and caveat checking. Each component operates independently to verify a specific aspect of authentication, creating layered security that prevents single-point failures and reduces vulnerability to security breaches
Solution Approach 2:
The authentication request structure implements nesting where the user object contains a copy of the workstation message, which itself contains the workstation object and signature. This nested structure ensures that user authentication is bound to workstation authentication, creating dependent verification layers that strengthen overall security
2Ease of operation
If only user credentials are verified, then authentication is simple, but workstation spoofing and signature substitution attacks are possible
Solution Approach 1:
The system merges workstation authentication and user authentication into a single unified process. The workstation message containing the workstation object and signature is embedded within the user message structure, so that user authentication cannot be completed without first validating workstation credentials. This combination eliminates the ability to perform workstation spoofing or signature substitution attacks independently
Solution Approach 2:
The workstation authentication is performed as a preliminary action before user authentication. The workstation message is validated first, including certificate verification and signature checking, establishing a secure foundation before the user credentials are verified. This preliminary validation prevents spoofing attempts from succeeding
3Productivity
If authentication only checks certificates, then the process is fast, but granular control over access is limited
Solution Approach 1:
The system dynamically adjusts authentication requirements based on caveat evaluations. After validating certificates and signatures, the system retrieves and evaluates caveats associated with both the workstation and user, making access decisions based on the intersection of their credentials. This dynamic approach allows granular control over access while maintaining efficient certificate-based validation
Data Source
AI summary
In accordance with the teachings of the present invention, a system and method for dynamic, multi-attribute authentication are provided. In a particular embodiment, a method for authentication includes receiving, at an authentication web server, an authentication request comprising a workstation message and a user message, wherein the workstation message comprises a workstation object and a workstation signature, the workstation object comprises a workstation certificate associated with a workstation, the user message comprises a user object and a user signature, and the user object comprises a copy of the workstation message and a user certificate associated with a user of the workstation. The method further includes verifying the workstation signature and user signature, validating the workstation certificate and the user certificate, retrieving one or more caveats associated with the workstation and one or more caveats associated with the user, and determining one or more caveats associated with both the workstation and the user.