Mobile-Initiated Authentication via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems impose friction on users and are vulnerable to attacks, particularly in federated identity management systems, where repeated authentication requests increase the attack surface and can be compromised by malicious code on mobile devices.
Innovation Solution
A mobile-initiated authentication process using a trusted execution environment on a mobile device to securely manage credentials and policies, allowing users to authenticate without exposing actual credentials, and enabling offline access through a decentralized identity management system on a blockchain-based platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If out-of-band authentication is implemented using push notifications to mobile devices, then security is improved by adding additional verification factors, but user friction increases due to repeated authentication requests across multiple services
Solution Approach 1:
The system performs preliminary authentication actions by establishing a trusted execution environment on the mobile device and pre-registering authentication capabilities. This allows the device to autonomously handle authentication requests without requiring user intervention for each service, reducing friction while maintaining security.
Solution Approach 2:
The mobile device's trusted execution environment autonomously manages authentication credentials and policies without requiring continuous user input. The system self-services by automatically responding to authentication requests from multiple services, eliminating the need for repeated manual verification while maintaining strong security through cryptographic proof of authentication.
2Ease of operation
If multiple authentication sessions are maintained across different online services, then access convenience is improved, but the attack surface expands creating more vulnerability to compromise
Solution Approach 1:
The system extracts the authentication credential management from the vulnerable networked environment and places it within the isolated trusted execution environment on the mobile device. Only cryptographic proofs of authentication are transmitted over the network, not the actual credentials, thereby maintaining access convenience while removing the attack surface for credential theft.
Solution Approach 2:
The trusted execution environment acts as an intermediary that mediates between the user's identity and the external services. It generates cryptographic proofs that convince services of authentication without exposing actual credentials, thus enabling convenient multi-service access while preventing credential compromise attacks.
3Speed
If credentials are stored on mobile devices for authentication, then authentication speed is improved, but vulnerability to malicious code increases
Solution Approach 1:
The authentication credentials are nested within the trusted execution environment, which is a secure, isolated runtime environment on the mobile device. This nested structure allows fast authentication access while protecting credentials from malicious code in the broader system, as the TEE's hardware-enforced isolation prevents unauthorized access even if the main operating system is compromised.
Data Source
AI summary
Provided is a process that establishes representations and permits users to login to a relying device to which a mobile device has registered. Credential values of the user are established within a trusted execution environment of the mobile device and representations of those credentials are transmitted to a server. The user of the mobile device may authenticate with the mobile device to the server, which may permit user access to the relying device via secure session. The user of the mobile device may authenticate with the mobile device to the server, which may permit user access by causing the mobile device to obtain a value by which the relying device may be accessed. The user of the mobile device may authenticate with the mobile device based on a policy received from the server to obtain a value by which the relying device may be accessed.