Multi-Factor Authentication Possession Factor Loss Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access-control systems face challenges in preventing loss of possession factors during multi-factor authentication, leading to user lockouts when possession factors are lost, as standard recovery methods cannot effectively replace lost possession factors.
Innovation Solution
Implement a system that monitors attributes of possession factors, such as phone numbers, locations, and software tokens, to detect potential loss and performs security actions like notifying users to register backup factors, ensuring continuous authentication capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication using possession factors is implemented to increase security, then security level is improved, but user accessibility deteriorates when possession factors are lost
Solution Approach 1:
The system proactively monitors attributes of possession factors (device location, usage patterns, associated phone numbers) to detect potential loss before it occurs. When loss is predicted, the system notifies users in advance, allowing them to take preventive actions such as registering backup possession factors or resetting authentication credentials before being locked out
Solution Approach 2:
The system continuously monitors attributes of possession factors and provides feedback to users about the status and security risk level. When changes in attributes indicate potential loss (e.g., device lost, phone number changed), the system sends notifications and alerts users to take corrective actions, creating a closed-loop feedback mechanism that maintains both security and accessibility
2Ease of operation
If standard recovery methods (email reset, knowledge-factor based authentication) are used to recover lost possession factors, then user recovery options are provided, but security is compromised because these methods can defeat the purpose of requiring possession factors
Solution Approach 1:
The system introduces an intermediary monitoring layer that tracks attributes of possession factors (device identifiers, associated phone numbers, location data, usage patterns) without directly accessing the authentication credentials. This intermediary layer detects loss conditions and triggers recovery procedures that maintain security by not relying on traditional knowledge-factor-based methods that could be bypassed
3Reliability
If users are required to maintain multiple possession factors to prevent lockout, then reliability is improved, but device complexity increases
Solution Approach 1:
The system proactively monitors attributes of existing possession factors to predict loss before it occurs. By detecting early signs of loss (device lost, phone number changed, unusual usage patterns), the system notifies users in advance, giving them time to register backup possession factors voluntarily rather than requiring all users to maintain multiple factors simultaneously
4Reliability
If the system monitors attributes of possession factors to detect loss, then user notification capability is improved, but loss of time occurs due to continuous monitoring and processing
Solution Approach 1:
The system monitors a selective set of attributes that are most indicative of possession factor loss (device location, associated phone numbers, usage patterns) rather than continuously monitoring all possible attributes. This partial monitoring approach provides sufficient detection capability while minimizing the time and computational resources required
Data Source
AI summary
The disclosed computer-implemented method for preventing loss of possession factors may include (i) identifying an account of a user that is associated with a possession factor that is used by the user to perform a multi-factor authentication procedure that is required when accessing the account of the user, (ii) monitoring one or more attributes of at least one of the user and the possession factor, (iii) determining, based at least in part on the one or more attributes of at least one of the user and the possession factor, that the possession factor has likely been lost, and (iv) performing a security action in response to determining that the possession factor has likely been lost to prevent the user from being unable to perform the multi-factor authentication procedure. Various other methods, systems, and computer-readable media are also disclosed.