Multi-Party Authentication System Using Segmented Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems are insecure due to reliance on passwords, are complex for users, and lack user control, with existing solutions like OTPs and PKI systems being prone to attacks and difficult to implement.
Innovation Solution
A multi-party authentication system utilizing an authentication server that manages user and provider credentials, enables secure token-based authentication, and allows users to select authentication factors, including biometrics, with features like liveness checks and public/private key cryptography, ensuring secure and user-friendly authentication across multiple service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are used for authentication, then users can easily remember and operate the system, but security is compromised as passwords are easy to crack, guess, and subvert
Solution Approach 1:
The authentication credentials are segmented into two parts: a user-controlled portion stored on the user device and a service provider-controlled portion stored on the service provider system. This segmentation allows users to operate with simple credentials while security is maintained through the distributed credential structure that requires both parts for successful authentication.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using a challenge-response protocol with cryptographic proof. Instead of directly transmitting passwords, the system uses an intermediary verification process where the user device proves knowledge of the credential without revealing it, mediated through cryptographic challenges and responses.
2Reliability
If stronger authentication methods like OTP or PKI are used, then security is improved, but system complexity increases making them difficult to implement and manage
Solution Approach 1:
The patent extracts the complex key management and credential verification operations from the user device and concentrates them on the service provider system. The user device only needs to store simple credential portions and perform basic cryptographic operations, while the service provider handles the complex verification logic, thus reducing device complexity for users.
Solution Approach 2:
The patent creates a universal authentication framework that can work with multiple service providers and different types of credentials. The challenge-response mechanism and credential structure are designed to be provider-agnostic, allowing the same user device to authenticate across different services without requiring device-specific implementations for each provider.
3Reliability
If users have control over their authentication data to prevent fraud, then security is improved, but user operation becomes more complicated
Solution Approach 1:
The patent implements self-service authentication where the user device autonomously generates cryptographic proofs and manages its own credential portions without requiring user intervention for complex operations. The user simply needs to provide basic input while the device handles the sophisticated security operations automatically, maintaining both security control and operational simplicity.
4Reliability
If additional authentication factors are required, then security is strengthened, but the authentication process becomes more complicated for users
Solution Approach 1:
The patent merges multiple authentication factors into a single integrated credential structure. Instead of requiring separate processes for different authentication methods, the challenge-response mechanism combines knowledge-based authentication, possession-based authentication, and optionally biometric authentication into one unified flow that the user experiences as a single process.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A user device transmits a login request. A provider server, receives a random number from and transmits other information to an authentication server. The provider server transmits the random number to the device. The random number is transferred to a second user device, which transmits it to the authentication server. The authentication server transmits provider authentication policy requirements and further transmits the other information to the second device. The second device transmits user validation information to the authentication server. The authentication server determines that the transmitted validation information corresponds to the service provider authentication policy requirements, compares the validation information with stored validation information for the user to authenticate the user. The second device transmits a message, including the random number and the other information, signed with a user credential to the authentication server. The authentication server transmits notice of authentication and the signed message to the provider server.