Password-less Authentication via Mobile Cryptographic Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The inefficiencies and security concerns associated with traditional password-based user authentication, including the need for multiple passwords, password forgetfulness, and the risk of password hacking or theft, necessitate a more reliable and secure authentication method.
Innovation Solution
A password-less authentication system that utilizes a mobile device to verify user identity through cryptographic keys and access notifications, allowing users to authenticate without entering a password by interacting with their mobile device to approve or deny access requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based authentication is used, then user identity verification can be achieved, but security risks increase due to password hacking, theft, and forgetfulness
Solution Approach 1:
The patent extracts the password from the authentication process entirely, replacing it with cryptographic key pairs. The private key remains securely stored in the user's mobile device, while the public key is used by the authentication server, eliminating the need for users to remember or transmit passwords that are vulnerable to hacking and theft.
Solution Approach 2:
The patent replaces the mechanical/password-based authentication system with a cryptographic system using asymmetric encryption. Instead of relying on users to manage complex passwords, the system uses cryptographic key pairs where the private key never leaves the user's device, providing security without human memory or password transmission.
2Adaptability or versatility
If multiple passwords are used for different services, then access control to various services is improved, but user complexity and difficulty of management increase
Solution Approach 1:
The patent creates a universal authentication mechanism where a single cryptographic key pair stored in the mobile device can authenticate the user across multiple services and platforms. The public key can be distributed to various service providers, allowing the same private key to prove identity across different services without requiring separate passwords for each.
Solution Approach 2:
The patent allows the public key to be copied and distributed to multiple service providers while the private key remains unique to the user's device. This enables the user to access multiple services using the same private key, eliminating the need to manage multiple passwords while maintaining service-specific access control.
3Reliability
If passwords are required for authentication, then identity verification can be performed, but user convenience decreases due to forgetfulness and frequent password changes
Solution Approach 1:
The patent enables the mobile device to self-manage the authentication credentials through cryptographic operations. The private key automatically signs authentication requests without requiring user memory or intervention, and the device itself manages the security of the credentials, eliminating the burden of password management from the user.
Solution Approach 2:
The patent replaces the human-memory-dependent password system with an automated cryptographic system. The mobile device automatically performs cryptographic signing operations using the private key, eliminating the need for users to remember, type, or change passwords while maintaining secure identity verification.
4Reliability
If cryptographic key pairs are used for authentication, then security is enhanced by eliminating passwords, but device complexity increases due to key management requirements
Solution Approach 1:
The patent merges the cryptographic key management functionality into the existing mobile device operating system and security infrastructure. By integrating the private key storage and cryptographic operations into the device's existing security model (such as secure enclaves or trusted execution environments), the system avoids adding separate complex key management infrastructure while maintaining high security standards.
Data Source
AI summary
A device may receive an authentication request generated based on a request to access a service. The authentication request may include a user identifier. The device may identify a mobile device associated with the user identifier. The device may authenticate the mobile device, and may generate an access notification based on authenticating the mobile device. The access notification may include information relating to the request to access the service. The device may provide the access notification to the mobile device, and may receive an access response from the mobile device. The access response may indicate whether to permit access to the service. The device may cause access to the service to be permitted when the access response indicates to permit access to the service, or may cause access to the service to be denied when the access response indicates to deny access to the service.