Multi-Second Factor Authentication for Sensitive Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication techniques are inadequate in mitigating threats from malicious entities compromising credentials and tampering with sensitive operations, such as infecting executable code with malware, and often rely on a single individual providing both authentication factors.
Innovation Solution
Implementing a method that secures a first authentication factor with multiple second authentication factors from different individuals, allowing a 1:N match, where N is a positive integer, to authorize sensitive operations, thereby enhancing security by requiring a threshold number of validated second authentication factors to complete the authorization process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional single-factor authentication is used, then the authorization process is simple and fast, but the security against malicious entities is insufficient
Solution Approach 1:
The authentication process is segmented into multiple independent factors (something you know, something you have, something you are) that must be validated separately. Each factor is processed through distinct verification steps, transforming a single complex authentication into multiple simpler, independent validation stages that collectively enhance security while maintaining manageable complexity
Solution Approach 2:
A service intermediary is introduced that coordinates between multiple authentication factors and the target service. This intermediary manages the complex multi-factor authentication process, handling factor validation, decision logic, and authorization granting, thereby isolating the complexity from both the user and the service while maintaining strong security
2Reliability
If multiple authentication factors from different individuals are required, then security against credential compromise is improved, but the authorization process time increases
Solution Approach 1:
Authentication factors are collected and validated in advance before the actual authorization is needed. The system pre-verifies multiple factors from different individuals, stores the validation results, and uses these pre-computed results to rapidly grant authorization when needed, thereby separating the time-consuming validation work from the authorization decision moment
Solution Approach 2:
The authentication system dynamically adjusts the number and type of factors required based on risk assessment, user context, and service sensitivity. Rather than always requiring the maximum number of factors, the system adapts the authentication depth in real-time, reducing unnecessary delays for low-risk operations while maintaining strong security for high-risk operations
3Ease of manufacture
If automated build processes use unprotected credentials, then the build automation is simple to implement, but the sensitive operations are vulnerable to compromise
Solution Approach 1:
Instead of using a single unprotected credential in automated build processes, the system creates multiple credential copies distributed to different individuals or systems. Each credential is bound to specific authorization scopes, and the build process requires coordinated validation of multiple credential copies, preventing compromise of a single credential from exposing the entire system while maintaining automated operation
Data Source
AI summary
A method for securing and authorizing sensitive operations is described. A computing device may receive a first authentication factor from a second computing device based on a request from the second computing device to authorize an operation; upon validating the first authentication factor, send to at least the second computing device and a third computing device, a request for a second authentication factor; and authorize the operation based on validating the second authentication factor from the second computing device or from the third computing device, or from both.