Multi-Factor Authentication with Device and Location Pre-Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor authentication methods, such as tap-to-login processes, are prone to human error, server resource inefficiencies, and unauthorized access due to timeouts and geographical location vulnerabilities, which can lead to data breaches.
Innovation Solution
Implementing a system where a push notification during authentication is only received if the mobile device and user are authenticated first, with the option for the device or server to reject or not forward requests, and requiring both devices to be in close geographical proximity, thereby enhancing security and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional username and password authentication is used, then ease of operation is improved, but security deteriorates due to human error and bot attacks
Solution Approach 1:
The authentication process is segmented into distinct phases: device authentication phase (where the mobile device authenticates itself to the server) and user authentication phase (where the user provides biometric or knowledge-based verification). This segmentation allows each phase to be optimized independently, with device authentication happening once and user authentication requiring active participation, thereby improving both ease of operation and security.
Solution Approach 2:
The mobile device performs preliminary authentication with the server before receiving any push notifications. This preliminary action establishes a secure channel and authenticates the device's identity, ensuring that only authenticated devices can receive or respond to authentication requests. This prevents unauthorized devices from participating in the authentication process.
2Reliability
If push notifications are sent to mobile devices for authentication, then security is improved, but server resource usage increases and timeouts occur
Solution Approach 1:
The server performs preliminary verification to ensure the mobile device is authenticated before sending any push notifications. This preliminary action filters out unauthenticated devices early in the process, preventing server resources from being wasted on devices that should not receive notifications. It also establishes clear authentication state, eliminating ambiguities that lead to timeouts.
Solution Approach 2:
The system implements feedback mechanisms where the authenticated mobile device sends confirmation signals to the server about its authentication state and notification receipt. This feedback loop allows the server to track which devices are authenticated and have received notifications, enabling better resource management and reducing timeouts by knowing the current state of each device.
3Reliability
If location verification is added to authentication, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The server acts as an intermediary that handles location verification rather than requiring the mobile device to perform complex location checks. The server receives location data from authenticated devices and performs the verification logic centrally, simplifying the device-side implementation while maintaining strong security. This intermediary approach distributes complexity appropriately across the system architecture.
4Reliability
If multiple authentication factors are required, then security is improved, but ease of operation deteriorates due to multiple steps
Solution Approach 1:
Device authentication is performed as a preliminary action that happens automatically in the background before the user needs to provide any input. Once the device is authenticated, the user only needs to provide their biometric or knowledge-based factor, significantly reducing the number of steps they must manually complete while maintaining multi-factor authentication security.
Solution Approach 2:
The mobile device performs self-authentication with the server without requiring user intervention. The device automatically proves its identity and authentication state to the server, handling the complex device verification process autonomously. This self-service approach eliminates the need for users to manually configure or verify device credentials, improving ease of operation while maintaining security.
Data Source
AI summary
A multi-factor authentication method and system is provided such that a push notification during an authentication process is only received if a mobile device and user are authenticated prior to receiving the push notification. Either the mobile device itself or a second device sending the push notification may be programmed to either reject or not forward the authentication request. Additionally, using the method of the present invention, enhanced security is provided by requiring the location of the mobile device and the second device to be approximately in the same geographical location.