Policy Handlers for Multi-Factor Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current client-server models face challenges in securely managing multi-factor authentication policies, particularly in enforcing robust access controls across diverse client environments with varying security strengths and sensor technologies.
Innovation Solution
The implementation of a distributed system using policy handlers within the client environment, which provision and enforce multi-factor authentication policies through a hierarchy of Trusted Execution Environments (TEEs), leveraging technologies like Intel Manageability Engine and ARM TrustZone, to combine multiple security credentials and contextual requirements for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication policies are enforced across diverse client environments, then security is improved, but device complexity increases due to varying sensor technologies and security strengths
Solution Approach 1:
The authentication system is segmented into multiple independent factors (biometric sensors, security credentials, contextual information) that can be evaluated separately. Each factor is processed by dedicated policy handlers that assess specific authentication requirements, allowing the system to manage complexity through modular evaluation rather than monolithic processing.
Solution Approach 2:
The patent introduces a hierarchical dimension to authentication evaluation by organizing policy handlers into levels (e.g., sensor level, credential level, contextual level). This dimensional organization allows the system to process authentication requests through multiple layers of verification, each handling specific aspects of security without requiring all components to operate at the same complexity level.
2Reliability
If multiple security credentials and contextual requirements are combined for authentication, then access control robustness is improved, but the difficulty of detecting and measuring authentication compliance increases
Solution Approach 1:
Policy handlers serve as intermediary components between multiple authentication factors and the central authentication system. Each handler independently evaluates specific credentials and contextual requirements, then aggregates results to determine overall compliance. This intermediary layer simplifies detection by breaking down complex authentication verification into manageable, independently measurable units.
Solution Approach 2:
The system implements feedback mechanisms where policy handlers report authentication factor compliance status back to the central authentication system. Each handler provides discrete feedback about its evaluated factor (e.g., biometric match result, credential validation status), enabling the system to measure overall authentication compliance by aggregating these individual feedback signals.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, apparatus, systems and articles of manufacture are disclosed to facilitate multi-factor authentication policy enforcement using one or more policy handlers. An example first policy handler to manage a global policy in a distributed environment includes a parser to identify a first sub-policy of the global policy that is capable of enforcement by the first policy handler, and an attester to sign the first sub-policy. The example first policy handler further includes a director to determine whether to forward the global policy to a second policy handler based on a signature status of the global policy, and to forward the global policy to the second policy handler when the signature status of the global policy is indicative of an unsigned second sub-policy.