Multi-Device FIDO Validation Using Device-Specific Public Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
FIDO servers struggle to distinguish between multiple devices sharing the same digital credential, leading to redundant registration processes and inability to trace which device is accessing the server.
Innovation Solution
A secondary user device receives a unique digital credential signed with the private key of a primary user device, allowing the FIDO server to verify and authorize the secondary device without a separate registration process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a digital credential is shared among multiple devices, then ease of access to user accounts is improved, but the ability to distinguish between devices is lost
Solution Approach 1:
The patent divides the authentication system into two parts: a shared digital credential (passkey) that enables multi-device access, and a device-specific public key that provides device identification. The FIDO server stores mappings between device identifiers and public keys, allowing it to distinguish devices while users experience seamless access using the shared credential.
2Loss of information
If a separate registration process is required for each device, then device distinction capability is maintained, but device complexity and time consumption increase
Solution Approach 1:
The system performs preliminary action by having the primary device register its public key with the FIDO server during initial setup. When a secondary device wants to access the account, it uses the shared digital credential to authenticate, and the server automatically associates it with the primary device's registration, eliminating the need for separate registration while maintaining device distinction.
3Reliability
If device-specific key pairs are used for each device, then security is improved, but the ability to synchronize credentials across devices is lost
Solution Approach 1:
The patent creates a universal authentication system where a single digital credential (passkey) can be used across multiple devices. The FIDO server maintains a mapping between device identifiers and public keys, allowing the same credential to authenticate on different devices while the server knows which device is accessing the account through the device-specific public key association.
Data Source
AI summary
Provided are systems and methods for uniquely identifying a secondary user device which shares a FIDO credential with a primary user device. In one example, a method may include registering a first user device as a primary user device of a user account at a Fast Identity Online (FIDO) server, wherein the registering comprises receiving a public key generated by the first user device from the first user device, receiving a registration request for the user account from a second user device, wherein the registration request comprises a signed device public key of the second user device, verifying the signed device public key of the second user device based on the public key of the first user device, and in response to the verification, registering the second user device as a secondary user device of the user account at the FIDO server.