Multi-party Cloud Authenticator Using Segmented Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud authentication systems face challenges in scalability and security, particularly in the need for users to enroll multiple authenticators with each online service, leading to user burden and potential security risks due to the storage of raw credentials by naive cloud authenticators.
Innovation Solution
A multi-party cloud authentication system where a user device and a cloud authenticator share complementary credential portions, using a threshold signature algorithm to authenticate, ensuring that neither entity can complete the authentication without cooperation, thus enhancing security and convenience by allowing multiple devices to access online services without individual enrollment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a naive cloud authenticator stores raw credentials to enable authentication, then authentication functionality is achieved, but security is compromised due to the risk of credential exposure
Solution Approach 1:
The authentication credential is segmented into multiple credential portions, where each portion is stored by a different entity (user device, cloud authenticator, or third party). No single entity possesses the complete credential, thereby preventing credential exposure while maintaining authentication functionality. This is achieved through secret sharing schemes or distributed key management systems.
Solution Approach 2:
A third-party intermediary is introduced to hold a credential portion and facilitate the authentication process without exposing the complete credential. The intermediary enables secure authentication by coordinating between the user device and the service provider, acting as a trusted mediator that prevents direct credential exposure while maintaining system reliability.
2Adaptability or versatility
If multiple authenticators are enrolled with each online service to enable multi-device access, then device accessibility is improved, but user burden and enrollment complexity increase
Solution Approach 1:
The system implements a universal credential structure that can be used across multiple online services and devices without requiring separate enrollment for each service. The distributed credential portions can be reused and combined in different authentication scenarios, providing multi-functionality and reducing enrollment complexity while maintaining adaptability to various devices and services.
Solution Approach 2:
The credential portions are pre-distributed to multiple entities (user device, cloud authenticator, third party) during an initial setup phase. This preliminary action enables subsequent authentication operations to proceed without repeated enrollment, reducing user burden and complexity while allowing flexible multi-device access. The pre-established trust relationships facilitate seamless authentication across different devices and services.
3Speed
If a single entity holds the complete authentication credential, then authentication speed is improved, but security is reduced due to the single point of failure
Solution Approach 1:
The complete authentication credential is segmented into multiple portions held by different entities. During authentication, these portions are quickly combined through efficient cryptographic operations (such as secret reconstruction or signature generation), maintaining authentication speed while eliminating the single point of failure. The segmented structure ensures that compromise of one portion does not endanger the entire credential.
Solution Approach 2:
The system changes the parameter of credential distribution from centralized to distributed, transforming the security model from single-point vulnerability to multi-point resilience. By altering how the credential is stored and managed (distributed across multiple entities rather than concentrated in one), the system maintains authentication performance while significantly improving security robustness against theft, loss, or compromise.
Data Source
AI summary
This disclosure describes techniques for authenticating one or more devices of a user in association with cloud computing services. The techniques include generating credential portions. The credential portions may be used in a signing protocol between one of the user devices and a cloud authenticator. The signing protocol may generate a signature that may be used in authentication with a cloud computing service. In some cases, the credential portions may be shared with other devices of the user. As such, the cloud authenticate may assist multiple user devices to authenticate with the cloud computing service.