Passwordless Authentication via Device-Bound Session ID
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security techniques are inadequate due to their reliance on outdated perimeters, vulnerability to attacks, and requirement for passwords or biometrics, which are cumbersome and ineffective in modern cloud-based environments.
Innovation Solution
The implementation of a dual-mode, passwordless authentication system that uses physical authentication based on unique user characteristics and a unique session identifier, allowing users to access network-restricted resources without direct connection to the target resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are used for authentication, then users can access network resources, but security is weakened and users must memorize and manage credentials continuously
Solution Approach 1:
The patent extracts the authentication credential from the user's memory and replaces it with a device-bound session identifier. The session ID is generated once during initial authentication and stored in secure memory of the client device, eliminating the need for users to memorize passwords while maintaining security through device-specific binding.
Solution Approach 2:
The patent creates a copy of the authentication mechanism that is bound to the specific client device. The session identifier acts as a device-specific copy that can be used for authentication only on that particular device, replacing the universal but vulnerable password credential.
2Ease of operation
If biometrics alone are used for authentication, then password management is simplified, but security is vulnerable to biometric duplication attacks
Solution Approach 1:
The patent merges two authentication factors: physical biometric characteristics and a device-bound session identifier. The biometric verifies the user's physical identity, while the session ID verifies possession of the authenticated device, creating a combined authentication mechanism that is more secure than biometrics alone while maintaining ease of use.
3Reliability
If firewalls and perimeters are used to control access, then network security is maintained, but user freedom and productivity are limited
Solution Approach 1:
The patent transitions from static perimeter-based security to dynamic authentication. Instead of blocking all external access, the system dynamically evaluates each access request based on the user's authenticated identity and device binding, allowing flexible access patterns while maintaining security through continuous verification.
4Speed
If direct connection between client device and target resources is allowed, then access speed is improved, but security risks increase due to unrestricted lateral movement
Solution Approach 1:
The patent introduces an authentication intermediary that sits between the client device and target resources. The session identifier acts as a mediator that verifies the user's authenticated status and device binding before allowing access, enabling direct connections while maintaining security through the intermediary verification layer.
Data Source
AI summary
Disclosed embodiments relate to passwordless authentication. Techniques include identifying a request by a user to access an access-restricted target resource, the user operating on a client computing device and the request being associated with a network address for the access-restricted target resource; intercepting the request; generating a unique session identifier for the user; making available the unique session identifier to the user of the client computing device; performing dual-mode, passwordless authentication of the user; confirming, based on the dual-mode, passwordless authentication of the user, the identity of the user and the user's current use of the client computing device; and permitting, based on the confirmation, the user to access the access-restricted target resource.