Multi-Device Authentication Enrollment with Selective Capability Disclosure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems require exhaustive communication of client authentication capabilities over a network, leading to privacy concerns and inefficient management of authentication devices, and they fail to handle random challenges effectively, resulting in user denial during authentication attempts.
Innovation Solution
Implementing a query policy where a secure transaction server transmits a policy to the client, allowing the client to identify a subset of authentication capabilities, enabling simultaneous provisioning and authentication of multiple devices, and automatically handling expired random challenges without user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the client communicates all authentication capabilities to the server, then the server can verify all devices, but the client's privacy is compromised and information disclosure increases
Solution Approach 1:
The patent extracts only the necessary authentication capabilities from the client's full capability set. The server sends a query policy specifying which capabilities are needed, and the client responds with only those specific capabilities rather than all available ones, thus verifying authentication reliability while minimizing privacy loss.
Solution Approach 2:
The authentication capability communication is segmented into multiple stages: first the server communicates its policy requirements, then the client provides only the relevant subset of capabilities. This segmentation allows verification to proceed without requiring complete capability disclosure upfront.
2Ease of operation
If the system handles authentication devices one at a time, then the authentication process is simple, but the time required for enrolling and registering multiple devices increases
Solution Approach 1:
The patent merges multiple authentication device enrollments and registrations into a single batch operation. The server can issue multiple random challenges simultaneously, and the client can enroll multiple devices in parallel, combining what would otherwise be sequential operations into concurrent processes that complete faster while maintaining operational simplicity.
Solution Approach 2:
The system performs preliminary actions by pre-generating multiple random challenges and preparing authentication contexts before actual device enrollment begins. This allows the authentication framework to be ready to handle multiple devices simultaneously, reducing the overall time required for multi-device enrollment.
3Reliability
If the server sends random challenges to authenticate devices, then security is enhanced, but the challenges may expire before completion causing authentication denial
Solution Approach 1:
The client performs preliminary actions by monitoring the expiration times of received random challenges and preparing to request new challenges before the current ones expire. This proactive approach ensures that authentication can continue without interruption or denial due to expired challenges, while maintaining the security benefits of time-limited challenges.
Solution Approach 2:
The system implements feedback mechanisms where the client monitors challenge expiration status and communicates with the server to request new challenges when needed. This feedback loop ensures that the authentication process adapts to timing constraints, preventing authentication denial while maintaining security through continued use of time-limited challenges.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A system, apparatus, method, and machine-readable medium are described for determining the authentication capabilities. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.