Two-Stage Authentication Using Dynamic Certificate Issuance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems using user IDs and passwords face security weaknesses, particularly when IP restrictions or VPNs are not employed, leading to increased management costs and reduced user convenience, especially in environments with variable IP addresses.
Innovation Solution
An authentication server issues a certificate to a client terminal, which is stored locally and used for first authentication, followed by transmission to the server for second authentication using a user ID and password, eliminating the need for pre-configured service environments and reducing reliance on IP restrictions or VPNs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication is performed using only user ID/password, then ease of operation is improved, but security strength deteriorates
Solution Approach 1:
The authentication process is divided into two independent stages: first authentication using a certificate (device-level verification) and second authentication using user ID/password (user-level verification). This segmentation allows each authentication method to operate independently, combining the security strength of certificate-based authentication with the ease of operation of username/password authentication.
2Reliability
If IP restriction or VPN is used to improve security, then security strength is improved, but ease of operation deteriorates
Solution Approach 1:
The system performs automatic certificate issuance and binding without requiring manual configuration of IP restrictions or VPN settings. The server automatically manages certificate distribution, binding, and validation, eliminating the need for users to manually set up complex network security configurations while maintaining strong security through certificate-based first authentication.
3Reliability
If certificate and user ID/password are pre-stored in authentication server database, then authentication reliability is improved, but device complexity and management cost increase
Solution Approach 1:
The system performs preliminary certificate issuance and binding automatically during the first authentication process. Instead of requiring pre-configured databases with pre-stored certificates and user credentials, the server dynamically issues certificates to client terminals and binds them to user accounts during initial authentication, eliminating complex pre-setup requirements while maintaining authentication reliability.
Data Source
AI summary
A certificate issued by an authentication server 200 in response to a request from a client terminal 100 is stored in an issued certificate storage unit 113, and the stored certificate is transmitted to the authentication server 200 together with device information to execute first authentication and then a user ID/password is transmitted to the authentication server 200 to execute second authentication, so that it is possible to perform the first authentication using a certificate and perform the second authentication using a user ID/password without setting up the service usage environment in which the certificate of the client terminal 100 and the user ID/password are stored in advance in the authentication server 200 so as to be associated with each other and the certificate is stored in advance in each client terminal 100.