Offline Two-Factor Authentication via Encrypted Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access control points without network connectivity face challenges in verifying two-factor authentication, as they cannot communicate with the access control system to validate biometric factors and access tokens.
Innovation Solution
A trusted administrative server generates an encoded encrypted access credential that includes a biometric factor and an access token, which can be decrypted and validated locally at the access control point, eliminating the need for network communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the access control point is not connected to a network, then operational independence and security are improved, but the ability to verify two-factor authentication and communicate with the access control system deteriorates
Solution Approach 1:
The access control system pre-generates and provides encoded encrypted access credentials to the access control point before the actual authentication event. This preliminary action enables the access control point to perform authentication locally without needing real-time network connectivity during the verification process.
Solution Approach 2:
An encoded encrypted access credential acts as an intermediary carrier that contains both the access token and biometric factor. This intermediary enables the access control point to store and verify authentication information locally while maintaining security, bridging the gap between network independence and authentication capability.
2Adaptability or versatility
If the access control point stores biometric factors and access tokens locally, then network connectivity requirements are reduced, but security risks increase due to potential data breaches or unauthorized access
Solution Approach 1:
Instead of storing raw biometric data and access tokens directly at the access control point, the system creates an encoded encrypted copy of the authentication credential. This copy contains the necessary authentication information in an encrypted format that can only be decrypted with the appropriate private key, reducing security risks while enabling local operation.
Solution Approach 2:
The access credential is transformed from unencrypted to encoded encrypted format, changing the security parameter of the stored data. This parameter change enables the access control point to store authentication information locally while maintaining security through encryption, balancing adaptability and security.
3Reliability
If the access control system requires network communication for authentication, then centralized control and security monitoring are improved, but system availability and response time deteriorate during network outages
Solution Approach 1:
The authentication process is segmented into two parts: the access control system generates and provides the encoded encrypted access credential (centralized control), and the access control point performs local verification using the provided credential (decentralized execution). This segmentation enables both centralized security control and fast local response during network outages.
Data Source
AI summary
Techniques for two factor authentication are provided. An access control point that is not connected to a network receives an encoded encrypted access credential that includes a biometric factor and an access token. The encoded encrypted access credential is decoded to extract a signed encrypted access credential. The signed encrypted access credential is decrypted at the access control point using a private key to create a signed decrypted access credential. The signed decrypted access credential is validated at the access control point. The biometric factor and the access token are extracted from the signed decrypted access credential. A user provided biometric factor is received. The user provided biometric factor is compared with the extracted biometric factor. Access via the access control point is provided when the comparing indicates the user provided biometric factor and the extracted biometric factor are the same and the access token indicates access should be allowed.