Identity Server Passwordless Authentication Centralized Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing passwordless authentication systems face limitations in centralized management and account recovery, particularly for enterprises, as they rely on user-controlled private key material and require explicit integration with each application, hindering IT departments' ability to administer credentials and manage access.
Innovation Solution
An identity server acts as an authenticator, managing user identities and credentials through a secure hardware storage module, enabling centralized IT management, role-based access control, and seamless account recovery by separating authentication into two exchanges, allowing multiple users to share credentials without revealing private keys and supporting various authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If passwordless authentication systems use user-controlled private key material, then authentication security is improved, but centralized IT management capability deteriorates
Solution Approach 1:
The patent introduces an identity server as an intermediary between users and relying parties. The identity server stores public keys and credential information, mediating the authentication process. This allows user-controlled private keys to maintain security while the identity server provides centralized management capabilities for credential issuance, revocation, and account recovery without requiring users to directly manage their cryptographic material.
2Adaptability or versatility
If explicit integration with each application is required, then authentication protocol compatibility is improved, but system complexity deteriorates
Solution Approach 1:
The identity server is designed as a universal platform that can authenticate users to multiple different relying parties across various applications and services. By implementing support for multiple authentication protocols (WebAuthn, FIDO2, etc.) within a single identity server, the system achieves broad protocol compatibility without requiring separate integration implementations for each application, thereby reducing overall system complexity.
3Ease of operation
If user accounts are shared among team members with shared secrets, then access management is improved, but security deteriorates
Solution Approach 1:
The patent segments the authentication credentials so that each user has their own private key and credential pair stored in their device's secure enclave. When team members need shared access, the identity server can issue different credentials to different users that all map to the same relying party account. This segmentation maintains security by ensuring no user has access to another's private key while still enabling shared access control through server-side credential management.
Data Source
AI summary
An identity server authenticates a first user identity for a user device through a first authentication exchange as part of a passwordless authentication system. The identity server registers with a relying party as an authenticator for a second user identity. The identity server initiates a second authentication exchange by obtaining from the relying party, a credential request associated with the second user identity. Responsive to a determination that the first user identity authenticated in the first authentication exchange is authorized to act as the second user identity, the identity server obtains a credential request response authenticated by the authenticator in the identity server. The identity server completes the second authentication exchange by providing the credential response to the relying party. The second authentication exchange authenticates the user device to the relying party without involving the user device.