Connection Resilient Multi-Factor Authentication Using Asymmetric Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication (MFA) technologies rely on network connectivity, making them unreliable during network outages and vulnerable to security breaches, particularly when a shared secret is compromised, leading to potential unauthorized access.
Innovation Solution
Connection Resilient Multi-Factor Authentication (CRMFA) employs encrypted random values generated by an authentication server, using different cryptographic algorithms for authenticator and target encrypted files, which are decrypted by the authenticator app and target machine respectively, ensuring secure authentication even without network connectivity and preventing shared secret misuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional multi-factor authentication is used with network connectivity, then authentication can be performed with centralized control, but the system becomes unreliable during network outages
Solution Approach 1:
The authentication system is segmented into distributed components: authenticator applications on user devices, target applications on service devices, and credential containers. Each component operates semi-independently, allowing authentication to proceed even when network connectivity to central servers is unavailable. The credential container stores authentication credentials locally, enabling offline authentication operations.
Solution Approach 2:
Authentication credentials and encrypted files are pre-loaded into the credential container before network outages occur. The system performs preliminary authentication setup and stores necessary cryptographic materials in advance, so that when network connectivity is lost, the pre-loaded credentials can be used immediately without requiring real-time network access.
2Ease of operation
If shared secrets are used for authentication, then simplified authentication protocols can be implemented, but the system becomes vulnerable to security breaches when secrets are compromised
Solution Approach 1:
The shared secret is extracted and replaced with individual cryptographic key pairs for each authenticator application. Instead of all devices sharing a common secret, each device generates its own private key and corresponding public key. The private key never leaves the device, eliminating the security vulnerability of shared secrets while maintaining authentication functionality through public key infrastructure.
Solution Approach 2:
The system transitions from symmetric authentication (shared secrets) to asymmetric authentication (public-private key pairs). Each authenticator has a unique asymmetric key relationship where the private key remains confidential to that device and the public key is shared. This asymmetric approach maintains authentication simplicity while eliminating the security risks inherent in symmetric shared secret systems.
3Duration of action of moving object
If encrypted files are stored indefinitely for authentication, then authentication can always be performed, but the risk of compromised devices increases over time
Solution Approach 1:
The credential container implements periodic expiration of stored encrypted files and credentials. Instead of indefinite storage, authentication credentials have defined validity periods and automatically expire after a certain time. This periodic renewal mechanism ensures that even if devices are compromised, the window of vulnerability is limited, and fresh credentials must be obtained through重新 authentication.
Solution Approach 2:
The system uses disposable, short-lived authentication credentials rather than permanent ones. Each encrypted file in the credential container has a limited lifespan and is designed to be replaced periodically. This approach trades the convenience of long-term credential validity for improved security, as compromised credentials automatically become useless after expiration, forcing attackers to continuously update their stolen credentials.
Data Source
AI summary
A first authenticator payload is obtained that includes a first authenticator random value. A first authenticator encrypted file is generated with an authenticator public key that is related to a client authenticator application. The first authenticator encrypted file is generated based on a first cryptographic algorithm. The first authenticator encrypted file includes the first authenticator payload. A first target payload is obtained that includes a first target random value. A first target encrypted file is generated with the first authenticator random value. The first target encrypted file is generated based on a second cryptographic algorithm. The first target encrypted file includes the first target payload.