Secure Peripheral Authentication for Continuous Zero-Trust Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for user access through a user access device to a service hosted by a distant server do not align with the zero trust security model, as they do not regularly verify user identity, considering all network traffic as untrusted.
Innovation Solution
A method and system that utilize a secure peripheral device connected to a user access device to continuously verify user identity during an ongoing application flow, using biometric data and a shared secret device key to authenticate the user, ensuring compliance with the zero trust security model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If user identity is checked once and for all via VNP solution, then user access to services is granted efficiently, but security compliance with zero trust model deteriorates
Solution Approach 1:
The system performs periodic authentication by sending authentication requests at regular intervals or at specific events during the user session. The server sends authentication requests containing challenges that require periodic verification of user identity, transforming the one-time authentication into repeated periodic authentication actions that comply with zero trust principles while maintaining efficient access.
Solution Approach 2:
The authentication process is made continuous rather than discrete. The system maintains an ongoing authentication state where the user's identity is continuously verified through periodic challenges and responses. This continuous authentication mechanism ensures that security verification is always active throughout the user session, preventing unauthorized access while allowing seamless service access.
2Reliability
If user identity is regularly verified during application flow, then security is enhanced according to zero trust model, but application flow complexity increases
Solution Approach 1:
The system introduces an intermediary authentication module that handles the complex verification processes. This module acts as a mediator between the user application and the security system, managing periodic authentication challenges and responses automatically. The intermediary absorbs the complexity of security verification, allowing the main application flow to remain simple while security is enhanced through automated periodic checks.
Solution Approach 2:
The authentication system performs self-service by automatically initiating and handling periodic verification without requiring explicit user intervention. The system autonomously sends authentication requests, processes challenges, verifies responses, and maintains authentication state. This self-service mechanism reduces the perceived complexity for users while implementing robust periodic security verification in the background.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for granting a user access through a user access device hosting a client application to a service of a server application hosted by a server, comprising: - receiving by said client application a service access request and forwarding it to said server, - sending by said server application a user authentication request, a primary challenge, an URL of said service, and a unique user identifier to said user access device that forwards them to a secure peripheral device hosting a device application, - upon receiving said user authentication request, checking by said device application the user identity, - building by said device application a flag according to said checking using the result of a comparison between user data signals and the ones that have been stored within said secure peripheral device during a user-device binding process, or relying on a last user authentication validity, - generating by said device application a primary response based on said flag, on said primary challenge, and on a secret device key associated to said unique user identifier and to said URL and which has been stored within said secure peripheral device during the user-device binding process, - sending by said device application said primary response to said user access device that forwards it to said server, - verifying by said server application the validity of said primary response, - according to said primary response, granting or denying by said server application the user access to said service.