Remote Private-Key Storage for Multi-Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods face challenges in providing high security and usability when users need to access secure services from multiple computing devices, as NIST requirements restrict private keys to a single location, complicating access and necessitating direct connections between hardware authenticators and devices.
Innovation Solution
A method and infrastructure that securely store a private key on a remote computing device accessible over an open network, enabling cryptographic operations through a secure connection, allowing multiple device access without direct physical connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a private key is stored on a user endpoint for software authenticator, then authentication security is improved, but multi-device access capability deteriorates
Solution Approach 1:
The authentication system is segmented into multiple components: the private key stored on a hardware authenticator device, the user endpoint for initiating authentication, and a server for verification. This segmentation allows the private key to remain secured on one device while enabling access from multiple endpoints through the authentication protocol.
Solution Approach 2:
A server acts as an intermediary between the user endpoint and the hardware authenticator device. The server receives authentication requests, facilitates the cryptographic protocol, and verifies signatures without requiring direct connection between the endpoint and hardware device, enabling multi-device access while maintaining security.
2Adaptability or versatility
If a hardware authenticator device is used to enable multi-device access, then adaptability is improved, but device complexity and procedural complexity worsen
Solution Approach 1:
The hardware authenticator device serves multiple functions: storing the private key securely, generating cryptographic signatures, and communicating with any authorized endpoint through the server. This multi-functionality eliminates the need for separate authentication mechanisms for different devices, reducing procedural complexity.
Solution Approach 2:
The authentication system implements feedback through the cryptographic protocol where the server verifies signatures and provides authentication results. This automated feedback mechanism reduces manual configuration and procedural complexity compared to manual key management approaches.
3Reliability
If direct connection between hardware authenticator and user endpoint is required, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The server acts as an intermediary that enables indirect authentication between the endpoint and hardware device. This approach maintains security through cryptographic verification while dramatically improving ease of operation by allowing wireless, remote authentication without direct physical connection or manual cable management.
Data Source
AI summary
Carrying out, over a network infrastructure, secure execution of cryptographic operations using a public/private key pair is described, wherein the private key is permanently stored on a second computing device that is remote to and accessible to the first computing device through an open network. The method includes establishing a secure connection over the open network between the first computing device and the second computing device, sending a file via the secure connection over the open network to the second computing device and instructing the second computing device to: encrypt or decrypt the file with a private key, of the public/private key pair, that is stored on the second computing device; and send the encrypted or decrypted file to the first computing device via the secure connection over the open network. The encrypted or decrypted file is then received over the open network from the second computing device.