Sensitive Data Access Authentication Using Score-Based Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication mechanisms do not account for the strength of authentication, leading to potential false acceptance when users barely meet hardcoded thresholds after multiple retry attempts.
Innovation Solution
A method using a secret sharing scheme to assign groups of secret shares to each authentication factor, where the number of shares released depends on the verification score, ensuring that a threshold is met before sensitive data is rebuilt.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a hardcoded threshold is used for biometric authentication to make it user-friendly, then ease of operation is improved, but reliability deteriorates due to false acceptance when users barely meet the threshold after multiple retry attempts
Solution Approach 1:
The patent segments the secret data into multiple secret shares and distributes them across multiple authentication factors. Instead of relying on a single threshold-based authentication, the system divides the authentication process into multiple independent factors, each contributing a portion of the secret shares. This segmentation eliminates the need for hardcoded thresholds while maintaining both user-friendliness and reliability.
Solution Approach 2:
The patent changes the authentication parameter from a fixed threshold value to a dynamic score-based system. Each authentication factor generates a score reflecting verification quality, and the number of secret shares released is adjusted based on this score and predefined parameters. This parameter change allows the system to adapt to different authentication qualities without compromising reliability.
2Reliability
If multiple authentication factors are used with score-based verification to prevent false acceptance, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent introduces secret shares as an intermediary mechanism between multiple authentication factors and the protected data. Instead of directly managing complex authentication logic, the system uses secret shares as intermediaries that are distributed across authentication factors and recombined based on verification scores. This intermediary approach simplifies the overall system architecture while maintaining high reliability.
Solution Approach 2:
The patent implements a dynamic authentication system where the number of secret shares released from each authentication factor is adjusted based on verification scores and predefined parameters. This dynamic approach allows the system to adapt to different authentication qualities in real-time, improving reliability while managing complexity through flexible, score-based share allocation rather than rigid multi-factor requirements.
3Reliability
If secret shares are distributed across multiple authentication factors with dynamic share release based on verification scores, then authentication strength is improved, but loss of time increases due to multiple checking steps
Solution Approach 1:
The patent applies partial action by releasing only the necessary number of secret shares based on verification scores rather than requiring all authentication factors to be fully verified. If early authentication factors produce high scores, sufficient secret shares can be released without proceeding to additional factors, thereby reducing authentication time while maintaining strength through score-based partial verification.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A method for managing a sensitive data in which each authentication factor in a set of authentication factors has been uniquely assigned a group containing several secret shares generated by using a secret sharing scheme. The method comprises: - a checking step in which a user provides an input, the is verified via an authentication factor to generate a score reflecting a level of confidence of the verification, a subset of the secret share(s) assigned to the authentication factor is added to a collection, the subset comprising a number of secret share(s) depending on both said score and a predefined parameter associated with the authentication factor, - a controlling step in which while the collection comprises a number of secret share(s) below a threshold, a further authentication factor is elected and a further checking step is, and - a generating step in which, once the number of secret shares of the collection has reached the threshold, the sensitive data is built from the secret shares of the collection by applying a predefined algorithm associated with the secret sharing scheme.