Dynamic User Identification With Biometrics for Passwordless Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication systems, particularly those relying on static user identifiers and passwords, are vulnerable to credential theft and compromise, and often burden users with multiple credentials, leading to poor user experience and reduced security.
Innovation Solution
Implement a dynamic user identifier (DID) system combined with biometric authentication, where a time-based token (e.g., TOTP) serves as the UID and facial recognition or other biometrics verify the user, eliminating the need for static credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static user identifiers and passwords are used for authentication, then the authentication process is simple and familiar to users, but the system is vulnerable to credential theft and compromise
Solution Approach 1:
The patent transforms static user identifiers into dynamic identifiers that change over time or with each authentication session. Instead of using a fixed username or email address, the system generates time-based or event-based identifiers that are unique to each authentication attempt, making stolen credentials useless for future attacks.
Solution Approach 2:
The patent changes the fundamental parameter of user identification from static to dynamic. By implementing identifiers that are generated based on time, random values, or cryptographic functions, the system fundamentally alters how user identity is represented and verified, eliminating the vulnerability of reusable static credentials.
2Reliability
If multiple credentials including passwords are required for authentication, then security is enhanced through multi-factor authentication, but user experience deteriorates due to the burden of memorizing and managing multiple credentials
Solution Approach 1:
The patent extracts and eliminates passwords from the authentication process entirely. By using dynamic identifiers combined with biometric authentication or other passwordless verification methods, the system removes the problematic password component while maintaining strong security through multi-factor authentication.
Solution Approach 2:
The patent substitutes the mechanical system of typing and memorizing passwords with biometric authentication or other automated verification methods. This replacement eliminates the cognitive burden of credential management while maintaining security through physiological or behavioral characteristics that are difficult to replicate.
3Ease of operation
If traditional password-based authentication is used, then the authentication process is straightforward, but the risk of unauthorized access increases due to password theft and compromise
Solution Approach 1:
The patent implements preliminary actions by generating and distributing dynamic identifiers to users before authentication is needed. These identifiers are pre-configured in authentication applications or devices, allowing users to authenticate without manually entering credentials, thereby eliminating the attack surface associated with password entry and transmission.
Solution Approach 2:
The patent introduces an intermediary component in the form of an authentication application or device that manages dynamic identifiers and communicates with the authentication server. This intermediary handles the complexity of credential management securely, protecting users from direct exposure to authentication mechanisms and reducing the risk of credential theft.
Data Source
AI summary
An embodiment includes receiving, from a device, at an authentication service, a dynamic user identifier having a one-time password in an authentication message constructed to carry the dynamic user identifier in place of a pre-determined user identifier of a user. The embodiment locates in a profiles database, using a customized search query with a code based on the dynamic user identifier, a user profile. The embodiment receives at the authentication service, a secondary identification data of the user including a biometric information of the user. The embodiment validates the biometric information using the user profile and enables, when the validating is successful, the device to perform an operation. The enabling is not based on the authentication service validating an entirely static user identifier and is not based on the authentication service validating a manually typed password.