Two-Factor Authentication for Shared Devices via Remote Identity Provider
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing two-factor authentication (2FA) for shared devices is complex, particularly in developing and deploying service-specific API keys and securely integrating 2FA protocols within client applications, which can lead to security vulnerabilities and management challenges.
Innovation Solution
The proposed solution involves delegating part of the 2FA activation and request-response exchange to a remote identity provider (IDP) that supports standard protocols like OpenID Connect (OIDC), thereby reducing the complexity for client applications and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client applications implement 2FA locally with service-specific API keys, then authentication security is improved, but device complexity and development burden increase
Solution Approach 1:
The patent introduces a remote identity provider as an intermediary service that handles 2FA operations externally. The identity provider receives authentication requests from the shared device, performs the complex 2FA logic, and returns results to the client application. This mediator approach allows the client application to maintain simple local logic while leveraging the security and complexity management capabilities of the remote identity provider.
2Ease of operation
If client applications manage 2FA protocols locally, then authentication functionality is achieved, but maintenance burden and development time increase
Solution Approach 1:
The patent extracts the complex 2FA protocol implementation and management responsibilities from the local client application and relocates them to a remote identity provider. The client application only needs to perform simple authentication requests and handle user interface interactions, while the identity provider manages the complex protocols, token generation, and verification logic externally.
3Adaptability or versatility
If service-specific API keys are deployed within client applications, then authentication control is achieved, but security vulnerabilities increase
Solution Approach 1:
The remote identity provider acts as a secure intermediary that receives authentication credentials and API keys from the shared device, validates them against stored credentials, and issues authentication tokens. This intermediary approach prevents the client application from storing or handling sensitive API keys locally, thereby eliminating the security vulnerability while maintaining authentication control capability.
Solution Approach 2:
The patent replaces the mechanical approach of storing and managing API keys within the client application with a remote authentication mechanism. Instead of embedding credentials locally, the system uses network-based authentication where the identity provider verifies credentials remotely and issues tokens, substituting the vulnerable local credential storage with a secure remote verification mechanism.
Data Source
AI summary
Systems, methods, and software can be used to perform a two-factor authentication. In some aspects, a method includes: receiving, by an electronic device from a device authentication server, a two-factor authentication (2FA) token; transmitting, by the electronic device to an identity provider (IDP), an authentication request for a 2FA operation, wherein the authentication request comprises the 2FA token; receiving, by the electronic device from the IDP, an authentication response; and determining, by the electronic device, whether the 2FA operation succeeds based on the authentication response.