FIDO Server Segmentation for Authentication Integration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The introduction of FIDO authentication technology is hindered by the need to modify or add functions to existing authentication servers, requiring service providers to temporarily suspend services and obtain certifications, which can be a barrier. Additionally, users face challenges with account recovery if their device is lost, stolen, or broken.

Innovation Solution

A separate FIDO server is introduced to handle FIDO authentication functions, allowing the authentication server to call upon these functions without needing modifications, and implementing a recovery mechanism using attribute-based encryption for account recovery.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If FIDO authentication function is added to authentication server, then FIDO authentication capability is improved, but device complexity and modification requirements increase

Engineering Contradiction:

ImproveFIDO authentication capabilityVSAvoidauthentication server modification

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system divides FIDO authentication functionality into a separate FIDO server component, independent from the authentication server. This segmentation allows the authentication server to maintain its original simplicity while the FIDO server handles all FIDO-specific operations including key pair generation, authentication token verification, and account recovery processes.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The FIDO server acts as an intermediary between the authentication server and user terminals. It receives authentication requests from the authentication server, processes FIDO-specific operations, and returns results. This intermediary role enables FIDO authentication capability without requiring modifications to the authentication server's core functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If authentication server is modified to support FIDO, then FIDO authentication is enabled, but service interruption and certification requirements increase

Engineering Contradiction:

ImproveFIDO authentication supportVSAvoidservice suspension and certification time

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

By segmenting FIDO functionality into a separate server, the system avoids service interruption. The authentication server continues operating with existing services while the new FIDO server runs independently, eliminating the need to suspend services for modifications.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The FIDO server implements self-contained FIDO authentication processing with built-in key management and recovery mechanisms. This self-service capability eliminates the need for external certification processes, as the system can autonomously manage FIDO credentials and recovery operations without requiring third-party validation.

Inventive Principle:

Principle #25Self-service

3Reliability

If recovery mechanism is implemented, then account recovery capability is improved, but system complexity increases

Engineering Contradiction:

Improveaccount recovery capabilityVSAvoidrecovery system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The FIDO server serves as an intermediary that manages recovery operations. When account recovery is needed, the authentication server delegates recovery requests to the FIDO server, which handles key pair generation, recovery token distribution, and verification. This intermediary approach enables robust recovery capability while keeping the authentication server simple.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary actions by pre-generating recovery key pairs and storing recovery tokens during initial setup. When account recovery is needed, these pre-prepared credentials enable immediate recovery without complex real-time generation processes, reducing system complexity during actual recovery operations.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12107956B2Information processing device, information processing method, and non-transitory computer readable storage medium

Publication Date: 2024.10.01 YAHOO JAPAN CORP

AI summary

An information processing device according to the present application includes a control unit. The control unit acquires, from an authentication server in a state in which a first authenticator used for FIDO authentication and a second authenticator used for recovery for the FIDO authentication cooperate with each other, a recovery execution request that is transmitted from a user terminal including the second authenticator to the authentication server, and if the recovery execution request meets a predetermined authentication condition that is set in advance, notifies the user terminal including the second authenticator of a recovery execution permission.