Passwordless Data Broker for FIDO-Secured OIDC Transfers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Historical data transfer systems rely on password-based authentications, which can lead to insecure data management and inefficient data transfer due to potential mismanagement and unauthorized disclosure, necessitating improved authentication and data transfer protocols.
Innovation Solution
A data broker system utilizing FIDO authentication and OpenID Connect authorization processes for passwordless and secure data transfer between entities, employing different access tokens and explicit user consents to manage data transfer without assuming ownership.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used in historical data transfer systems, then authentication can be implemented, but data security deteriorates due to potential mismanagement and unauthorized disclosure
Solution Approach 1:
The patent introduces a data broker as an intermediary entity that facilitates data transfer between data provider and data recipient without either party needing to store or manage the other's credentials. The data broker uses FIDO authentication to verify identities and OIDC authorization to manage permissions, eliminating the need for entities to directly handle sensitive authentication information while maintaining secure data transfer
Solution Approach 2:
The patent replaces traditional password-based mechanical authentication systems with FIDO (Fast Identity Online) authentication using cryptographic key pairs. Instead of relying on memorized passwords that are prone to mismanagement, the system uses public-key cryptography where the data provider's authentication private key signs authorization requests, and the data broker verifies these requests using the corresponding public key, thereby substituting a more secure cryptographic mechanism for the vulnerable password system
2Productivity
If historical data transfer systems take ownership of transferred data, then data transfer can be facilitated, but data security deteriorates due to unauthorized disclosure and mismanagement
Solution Approach 1:
The data broker acts as a mediator that enables data transfer without taking ownership of the data. It receives authorization from the data provider via FIDO authentication and OIDC authorization, then facilitates the transfer to the data recipient while maintaining that neither the broker nor any intermediary assumes ownership or control of the actual data, thereby enabling efficient transfer while preserving security
Solution Approach 2:
The patent extracts the ownership and control functions from the data transfer process itself. By separating authentication (FIDO), authorization (OIDC), and data transfer into distinct functional components, the system allows data to be transferred efficiently without any entity needing to take ownership, as the authorization tokens and cryptographic proofs enable trustless transfer that maintains data security
3Reliability
If password-based authentication is used, then authentication can be performed, but transaction efficiency deteriorates due to authentication overhead
Solution Approach 1:
The patent substitutes traditional password-based authentication with FIDO authentication that uses pre-established cryptographic key pairs. The data provider's authentication private key signs authorization requests once during setup, and these signed requests can be reused for multiple transactions without requiring repeated password entry or verification, thereby maintaining authentication capability while dramatically improving transaction efficiency through passwordless, cryptographic verification
Solution Approach 2:
The system performs preliminary authentication setup by establishing FIDO key pairs and OIDC authorization relationships before actual data transfers occur. This preliminary action creates reusable authorization tokens and cryptographic proofs that can be used across multiple transactions, eliminating the need for repeated authentication overhead and thereby improving transaction efficiency while maintaining security
Data Source
AI summary
A method, performable by a data broker, of securely transferring data without passwords may include registering an entity using a FIDO authentication process. The method may include associating, based on a receipt of first access token generated by a data provider using a first OIDC authorization process, the data provider with the entity. The method may include generating a second access token, using a second OIDC authorization process, associated with a data recipient. The method may include receiving a request to transfer requested data from the data provider to the data recipient. The request may include the second access token. The method may include transmitting the first long-lived token to the data provider for receiving the requested data. The method may include transmitting the requested data to the data recipient.