Passwordless SSO Credential Bundles for Zero-Knowledge Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional single sign-on (SSO) and passwordless sign-on procedures do not provide a way for users to obtain a decryption key that only they know, necessary for end-to-end encryption between the user and the web service or application, especially in zero-knowledge environments where the service provider does not have access to decryption keys.
Innovation Solution
A method involving a client device generating a symmetric device key for encrypting and decrypting a credential bundle, which includes keys for accessing cryptographically protected resources, using a password authenticated key exchange (PAKE) to establish secure sessions, and employing biometric authentication for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional SSO and passwordless sign-on procedures are used, then user authentication is simplified and access is granted, but users cannot obtain a decryption key that only they know for end-to-end encryption
Solution Approach 1:
The authentication system is segmented into two independent components: (1) identity verification through conventional SSO/passwordless methods with the service provider, and (2) device key generation and credential bundle decryption through the client application. This segmentation allows the user to authenticate via standard methods while simultaneously obtaining a decryption key that remains under their exclusive control, resolving the contradiction between ease of authentication and reliability of end-to-end encryption.
Solution Approach 2:
The client application acts as an intermediary between the service provider and the user's device key. It receives the credential bundle from the service provider after successful authentication, then uses the user's device key (stored locally in secure storage) to decrypt it. This intermediary role enables the user to maintain exclusive control of decryption keys while still benefiting from conventional SSO authentication mechanisms.
2Productivity
If the service provider stores decryption keys, then access to resources is facilitated, but the zero-knowledge environment and user control over data are compromised
Solution Approach 1:
The decryption key (device key) is extracted from the service provider's control and stored exclusively in the user's local device secure storage. The service provider only stores encrypted credential bundles without the ability to decrypt them. This extraction of the decryption key from the service provider's environment maintains the zero-knowledge architecture while still enabling resource access through the client application's decryption process.
Solution Approach 2:
The user's device key is used to decrypt the credential bundle locally on the user's own device, without requiring the service provider to perform decryption. This self-service approach ensures that only the user can access their encrypted data, maintaining the zero-knowledge environment while facilitating resource access through local decryption capabilities.
3Reliability
If a device key is generated and stored on the client device, then end-to-end encryption is enabled, but the system complexity increases
Solution Approach 1:
The device key generation, secure storage, and credential bundle decryption functions are merged into a single client application component. This consolidation simplifies the overall system architecture by integrating multiple security functions into one unified module, reducing the complexity that would arise from separate key management systems while maintaining robust end-to-end encryption capabilities.
Data Source
AI summary
Computer-implemented methods and systems for facilitating single sign-on (SSO) and passwordless sign-on to a web service provider are provided. A client device authorized for SSO or passwordless sign-on generates and stores a device-specific key that it uses to encrypt a credential bundle containing key(s) necessary to access a cryptographically protected resource provided by the web service provider. The encrypted credential bundle is stored by the web service provider and provided to the authorized client device upon a successful authentication via SSO or passwordless sign-on. The authorized device uses the locally stored device-specific key to decrypt the encrypted credential bundle received from the web service provider to obtain the key(s) necessary to access the cryptographically protected resource.