Multi-Node User Authentication with Secret Message Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for multi-node systems require multiple interactions with each node, degrading user experience and compromising user privacy due to each node gaining knowledge of the user ID.
Innovation Solution
A method involving a user application contacting multiple nodes, generating nonces, requesting authentication from an Identity Provider based on these nonces and a unique user identity, and using secure multi-party computation for verification among nodes to authenticate the user without revealing the entire message or identity to any single node.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the user performs authentication with each node separately, then the security and reliability of the system is improved, but the authentication process becomes lengthy and degrades user experience
Solution Approach 1:
The patent combines multiple authentication requests into a single interaction. The user application requests authentication from the Identity Provider once, receiving a single authenticated message that can then be distributed to multiple nodes. This merging of authentication operations reduces the number of interactions from multiple separate processes to a single process, directly resolving the contradiction between security (requiring multiple node authentication) and ease of operation (single authentication interaction).
Solution Approach 2:
The user application acts as an intermediary between the user and the nodes. It receives the authenticated message from the Identity Provider and then distributes it to the nodes, eliminating the need for the user to directly interact with each node separately. This intermediary approach allows the system to maintain security through multiple node verification while simplifying the user experience to a single authentication interaction.
2Ease of operation
If each node gains knowledge of the user ID, then the authentication process can be completed, but the privacy of the user may be breached or compromised
Solution Approach 1:
The patent segments the user ID into multiple parts or uses segmented authentication data. Instead of each node receiving the complete user ID, the system divides the authentication information so that nodes only receive necessary portions. This segmentation allows authentication to complete while preventing any single node from gaining full knowledge of the user identity, thus protecting user privacy.
Solution Approach 2:
Each node receives authentication data with local quality - only the specific information needed for its authentication function, not the complete user ID. The authentication message is customized for each node's needs while maintaining privacy. This local quality approach ensures nodes can authenticate users without compromising overall user privacy by revealing complete identity information.
Data Source
AI summary
A method for authentication of a user towards a multi-node party includes at least two nodes. The user contacts the nodes of the multi-node party, via a user application, and each of the nodes of the multi-node party generates a nonce and returns the nonce to the user application. The user application requests authentication from an Identity Provider, based on the nonces received from the nodes of the multi-node party and on a unique identity of the user. The Identity Provider generates a message, based on the request for authentication, and provides the message to the user application. The user application provides the message in a secret form to each of the nodes of the multi-node party. The nodes of the multi-node party verify the message by means of a multi-party verifying operation, and the user is authenticated based on the multi-party verifying operation.