Multi-Service Passkey Attestation via Server-Managed Certificate Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional password-based user authentication is vulnerable to security threats, and existing passkey services using a single attestation in a device are inadequate for multiple service applications, exposing security vulnerabilities and failing to meet individual service security requirements.
Innovation Solution
A multi-service attestation-based passkey service provision method that uses separate attestations for each service, managed by a server rather than individual devices, ensuring secure authentication through a certificate chain verification process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single attestation is stored in a device to provide passkey service, then device complexity is reduced, but security vulnerability increases due to private key exposure in memory
Solution Approach 1:
The patent divides the single attestation into multiple service-specific attestations (first service attestation, second service attestation, etc.). Each attestation is associated with a specific service and has its own private key stored in the service server, preventing private key exposure issues while maintaining manageable complexity through structured organization.
Solution Approach 2:
The patent introduces a server as an intermediary between the device and multiple service applications. The server stores and manages multiple service attestations and their corresponding private keys, acting as a secure intermediary that eliminates the need for the device to store multiple private keys in memory, thus reducing security vulnerabilities while maintaining systematic management.
2Ease of operation
If a single attestation is used to authenticate multiple services, then ease of operation is improved, but security requirements for individual services are not met
Solution Approach 1:
The patent segments the authentication mechanism by creating separate service attestations for different services (first service attestation for first service, second service attestation for second service). This segmentation allows each service to have its own security policies and authentication requirements while maintaining a unified passkey-based operation flow, thus meeting individual service security requirements without compromising ease of operation.
Solution Approach 2:
The patent applies local quality by associating each service attestation with specific service characteristics and security requirements. Each service server can have different security configurations, and the corresponding attestation is tailored to that service's needs, ensuring that each service receives appropriate security treatment while maintaining overall system ease of operation.
3Reliability
If separate attestations are used for different services, then individual service security requirements are met, but device complexity increases
Solution Approach 1:
The patent uses a server as an intermediary to manage the complexity of multiple service attestations. The server stores, manages, and distributes the appropriate attestation to each service application, shielding the device from the complexity of managing multiple attestations locally. This allows service-specific security to be implemented while the device maintains relatively simple architecture.
Solution Approach 2:
The patent implements self-service by enabling each service server to autonomously manage its own attestation and private key. Each service server can independently authenticate requests and manage its security credentials without requiring complex device-level coordination, thus reducing overall system complexity while maintaining service-specific security.
4Ease of manufacture
If private key is stored in device memory for attestation, then ease of manufacture is improved, but security vulnerability increases due to potential exposure
Solution Approach 1:
The patent extracts the private key storage function from the device memory and relocates it to the service server. The device only stores the public key or attestation data, while the private key resides securely in the service server's memory. This extraction eliminates the security vulnerability of private key exposure in device memory while maintaining ease of device manufacture, as the device architecture remains relatively simple.
Solution Approach 2:
The service server acts as an intermediary that securely holds the private key and performs cryptographic operations. Instead of the device storing and handling private keys directly, the server mediates the authentication process by receiving requests, performing verification using stored private keys, and returning authentication results. This intermediary approach eliminates private key exposure risks in the device while keeping device implementation straightforward.
Data Source
AI summary
The present disclosure according to at least one embodiment provides a multi-service attestation-based passkey service provision method performed by a computing device. The method comprises when there exists a request from a first service server, among a plurality of service servers that respectively provide services to a user terminal, for generating a first service attestation for security authentication of a first service, obtaining a first intermediate certificate generated by signing information included in the request using a root certificate previously registered in a server, obtaining the first service attestation generated by signing the first intermediate certificate using a private key stored in the first service server, and transmitting the first service attestation to the server.