Remote Server Authentication Using Ephemeral Wallet Confirmation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to authenticate a user's identity using an identity wallet in a way that ensures the Relying party can verify the specific instance of the wallet relevant to the context of use, excluding any other existing wallets, thereby compromising security.
Innovation Solution
A method where a remote server assigns a session reference and authentication request to a user agent, which delegates the request to an identity wallet. The wallet generates an ephemeral confirmation token displayed to the user, and the user enters a code, with the remote server verifying the proof of identity using a control token generated from this token.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the remote server uses traditional authentication methods with identity wallet, then user identity can be verified, but the system cannot ensure that the specific instance of wallet relevant to the context is being used, compromising security
Solution Approach 1:
The system performs preliminary actions by generating an ephemeral confirmation token before the authentication challenge, displaying it to the user in advance, and having the user enter it into the identity wallet. This preliminary action binds the user agent and identity wallet to the specific authentication session, ensuring that the wallet instance being used is the correct one relevant to the context, thereby improving authentication security without significantly increasing system complexity
Solution Approach 2:
The ephemeral confirmation token acts as an intermediary element that mediates between the user agent and the identity wallet. The token is generated by the user agent, displayed to the user, entered into the wallet, and then verified by the remote server. This intermediary mechanism ensures that the specific wallet instance is bound to the authentication session, resolving the security issue while maintaining a manageable system architecture
2Reliability
If the system uses ephemeral confirmation tokens with user input verification, then security against identity theft is enhanced, but the authentication process time increases
Solution Approach 1:
The ephemeral confirmation token is generated and displayed to the user in advance, before the authentication challenge is issued. This preliminary action allows the user to prepare the token input, so that when the authentication process begins, the user can quickly enter the token without delay. This approach enhances security by ensuring user involvement while minimizing the time penalty during the actual authentication process
Solution Approach 2:
The system rushes through the token verification process by having the remote server immediately verify the control token against the ephemeral confirmation token as soon as the wallet responds. This rapid verification minimizes the time the authentication process is extended, while still ensuring the security benefits of user input verification are fully realized
Data Source
AI summary
Provided is a method for managing a remote server that assigns to a user agent a session reference and a user authentication request. The user agent delegates the authentication request to an identity wallet that sends a proof of identity to the remote server. The user agent and the identity wallet are two separate devices, one of which generates and displays an ephemeral confirmation token and sends to the remote server a control token generated from the ephemeral confirmation token. The remote server grants rights associated to the session reference only if the proof of the identity is valid and if said checking is successful.