Passkey Device Registration for Shared Account Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Account sharing via shared login credentials leads to revenue loss for service providers as unauthorized users access services without payment, compromising the business model of streaming platforms and other service providers.
Innovation Solution
Implement a system that requires device-supported biometrics verification and passkeys for account access, using hardware identifiers (HWIDs) and public-private key pairs to authenticate devices, ensuring only registered devices can access accounts, and securely share passkeys between devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional shared login credentials are used, then ease of operation is improved, but security and revenue protection deteriorate
Solution Approach 1:
The authentication process is segmented into multiple stages: initial login with credentials, device registration with biometrics, and subsequent authentication using passkeys bound to specific devices. This segmentation allows the system to maintain ease of operation for authorized users while implementing robust security measures that prevent unauthorized access.
Solution Approach 2:
A passkey acts as an intermediary between the user's login credentials and the actual authentication process. The passkey is bound to specific device hardware identifiers and requires biometric verification, creating a secure intermediary layer that prevents credential sharing while maintaining convenient access for authorized devices.
2Reliability
If device registration with biometrics is required, then account security is improved, but device complexity increases
Solution Approach 1:
The system performs self-service authentication by automatically binding passkeys to device hardware identifiers and storing them securely. The biometric verification is handled automatically by the device's secure enclave, eliminating the need for manual configuration and reducing the perceived complexity for users while maintaining high security standards.
Solution Approach 2:
The authentication mechanism changes from static password verification to dynamic passkey verification that incorporates hardware identifiers and biometric parameters. This parameter change enhances security without significantly increasing user-facing complexity, as the system handles the cryptographic operations transparently.
3Ease of operation
If passkeys are shared between devices, then ease of operation is improved, but security deteriorates
Solution Approach 1:
Each passkey is configured with local quality by binding it to specific device hardware identifiers. This means that while passkeys can be shared across multiple devices, each device must have unique hardware characteristics and biometric verification capabilities, preventing simple credential sharing and maintaining security.
Solution Approach 2:
The authentication system adds a new dimension by incorporating hardware identifier binding and biometric verification into the passkey mechanism. This dimensional enhancement allows passkeys to function across multiple devices while maintaining security through the additional layers of hardware binding and biological verification.
Data Source
AI summary
A server receives a log in request with credentials. The server compares the credentials to stored account credentials. If matched, the server prompts the user to register a primary device. The server receives a passkey and a HWID associated with the primary device. The server stores these in a database. The server receives a second log in request message from a second device. The server transmits a certificate to the second device. The server receives a second HWID and the certificate, digitally signed using the passkey associated with the primary computing device and transmitted to the secondary device. The server verifies the digital signature and compares the second HWID to the stored HWID. Based on verifying the digital signature and determining that the second HWID does not match, the server prompts the user to register the second device. The server receives a second passkey and stores it in the database.