Group-ID Key Sharing for Adaptive Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods face challenges in providing non-intrusive, privacy-preserving, and adaptive authentication solutions that effectively manage risk based on user environment and location, while ensuring strong security and usability, especially in scenarios where explicit user interaction is not feasible and location data privacy is a concern.
Innovation Solution
The implementation of a non-intrusive privacy-preserving authentication system that uses a combination of non-intrusive authentication mechanisms, such as location and behavioral data, along with explicit user authentication, to dynamically adjust the assurance level and select appropriate authentication modalities based on the user's context, ensuring privacy protection and adaptive risk management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If explicit user authentication is required, then security is improved, but user friction and loss of time increase
Solution Approach 1:
The authentication system dynamically adjusts the required authentication strength based on the current risk assessment of the user's environment, location, and device state. When risk is low, the system allows authentication with minimal user interaction; when risk increases, it progressively requires stronger authentication methods, thereby adapting security requirements to actual conditions rather than applying static authentication rules
Solution Approach 2:
The system changes the authentication parameters (such as assurance level requirements, acceptable authentication methods) based on environmental factors including location data, device characteristics, and network conditions. This allows the system to modify authentication behavior in response to changing conditions, reducing user friction in safe environments while maintaining security when risks are detected
2Adaptability or versatility
If location data is collected for authentication, then adaptive authentication is improved, but user privacy is worsened
Solution Approach 1:
The system extracts only the necessary location information needed for authentication decisions while leaving detailed location data on the user's device. The authentication system processes location data locally or uses aggregated location patterns rather than transmitting specific location coordinates to remote servers, thereby extracting the essential authentication-relevant information while preserving user privacy
Solution Approach 2:
The system introduces an intermediary layer that processes location data without exposing it to the relying party or remote servers. This intermediary either processes location information locally on the device or uses encrypted/aggregated location data that cannot be traced back to specific user positions, thereby enabling adaptive authentication while protecting location privacy through the intermediary processing layer
3Adaptability or versatility
If multiple authentication devices are enrolled, then authentication flexibility is improved, but device complexity increases
Solution Approach 1:
The system implements a universal authentication framework that can work with multiple different types of authentication devices (biometric sensors, geographic location systems, device identifiers) through a common interface and assessment mechanism. This allows diverse authentication modalities to be enrolled and managed through a single system that assesses their combined strength, providing flexibility without requiring separate complex management systems for each device type
Data Source
AI summary
A system, apparatus, method, and machine readable medium are described for sharing authentication data. For example, one embodiment of a method comprises: generating and storing a persistent group identification code (Group-ID) for a group of authenticators sharing a common set of authorization (Uauth) keys, an initial Group-ID to be generated on a first use of a first authenticator and/or following a factory reset of the first authenticator generating and storing an individual asymmetric wrapping key encryption key (WKEK) on a first use of the first authenticator and/or following each factory reset of the first authenticator; generating and storing a symmetric wrapping key (WK), the wrapping key to be generated on a first use of the first authenticator and/or following each factory reset of the first authenticator; generating a join-block using an authenticator identification code for the first authenticator and the WKEK, the join-block usable to join an existing authenticator group, the join block to be sent to a second authenticator; verifying the join-block at the second authenticator and generating a join response block responsive to user approval, the join response block generated by encrypting the WK and Group-ID using the WKEK, the join response block to be transmitted to the first authenticator; and decrypting the join response block and storing the WK and Group-ID.