Password-less Authentication via Asymmetric Key Pairing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges with memorizing multiple passwords for various cloud services, leading to security concerns due to low password complexity and the complexity of two-factor authentication processes, which can be cumbersome and expose authentication servers to attacks.
Innovation Solution
A password-less authentication system that uses a method where a user device with pre-registered public and private encryption keys generates a verification response based on authentication request data and private user data, which is then verified by the service to grant access, eliminating the need for password memorization and reducing complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used, then users can access cloud services, but security is compromised due to low password complexity and users must memorize multiple passwords
Solution Approach 1:
The patent extracts the password from the authentication process entirely. Instead of using passwords, the system uses public-key cryptography where the user's public key is stored on the service provider's server and the private key remains on the user's device. Authentication is performed by signing a challenge with the private key, eliminating the need for password memorization while maintaining security.
Solution Approach 2:
The patent introduces a challenge-response mechanism as an intermediary between the user and the service provider. The service provider sends a random challenge to the user's device, which signs it with the private key and returns the signature. This intermediary process replaces direct password verification, enhancing security while simplifying user interaction.
2Reliability
If two-factor authentication is deployed, then security is enhanced, but the login process becomes complex and cumbersome for users
Solution Approach 1:
The patent extracts the second factor (physical token or software application) from the authentication process and replaces it with a cryptographic key pair. The private key stored on the user's device serves as the second factor, but unlike traditional two-factor authentication, it doesn't require users to carry or manage additional devices or applications, thereby reducing complexity while maintaining enhanced security.
Solution Approach 2:
The user's device autonomously performs the second factor authentication by automatically signing the challenge with the stored private key. This self-service mechanism eliminates the need for users to manually enter codes or interact with physical tokens, reducing the perceived complexity of the authentication process while maintaining security.
3Ease of operation
If credentials are stored in a single device or service, then users don't need to memorize multiple passwords, but the authentication server becomes a primary target for attackers
Solution Approach 1:
The patent segments the authentication credentials into two parts: the public key stored on the service provider's server and the private key stored on the user's device. This segmentation ensures that even if the server is compromised, attackers cannot authenticate as users without the private key. Conversely, if the user's device is compromised, the public key on the server can be revoked. This mutual distribution of credentials reduces the vulnerability of the authentication server while maintaining ease of credential management.
Solution Approach 2:
The patent implements preliminary action by having the service provider generate and store the user's public key before any authentication occurs. This pre-established cryptographic relationship allows for secure authentication without requiring the server to store sensitive passwords or secrets. The public key can be freely distributed and stored, reducing the server's attack surface while enabling convenient credential management.
Data Source
AI summary
A password-less authentication system is described herein. Also described are the devices used for such a system and the method and process implemented. The system employs asymmetric cryptography to enable users to log in to various systems or services on different platforms or computers by the aid of a mobile device. Users' credentials are kept privately in the mobile device, and not leaked to the network or any web service. In addition, the web service can verify users' authentication request by solely public information of users' credentials.