Shared Mobile Authentication Using NFC Passkeys and Biometrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods on shared mobile devices face security and efficiency challenges, particularly in environments where multiple users interact with a single device, necessitating secure and seamless access without personal ownership.
Innovation Solution
Utilizing RFID/NFC cards and biometric data for user identification, integrating with FIDO2 authentication, and employing a bridge device with BLE technology to facilitate communication between NFC/RFID readers and mobile devices, ensuring precise and secure authentication through unique identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password authentication is used on shared mobile devices, then security is compromised, but switching to FIDO2 authenticators requires additional hardware devices increasing device complexity
Solution Approach 1:
The mobile device itself is transformed into a multi-functional system that serves both as the authentication target and as the FIDO2 authenticator. The device's existing components (NFC reader, camera, fingerprint sensor, processor) are repurposed to perform cryptographic operations and generate authentication credentials, eliminating the need for separate hardware security keys while maintaining strong security.
Solution Approach 2:
A virtual authenticator application layer is introduced as an intermediary between the user's physical presence (biometrics or NFC card) and the FIDO2 authentication protocol. This software-based authenticator manages cryptographic keys and credentials within the mobile device's secure environment, bridging the gap between simple biometric/NFC input and complex cryptographic verification without requiring additional hardware.
2Reliability
If FIDO2 authenticators are used for secure authentication, then authentication security is improved, but user convenience deteriorates due to the need to carry and manage additional devices
Solution Approach 1:
The authentication system merges the credential verification function with the user's existing personal items (smartphone, NFC card, or biometric traits). Instead of requiring a separate FIDO2 security key, the system combines the mobile device the user already carries with their personal biometric data or NFC card to create the authenticator, making the security credential inseparable from the user's daily carry.
Solution Approach 2:
The mobile device automatically performs cryptographic operations and authentication verification without requiring manual intervention. The system self-manages key generation, credential storage, and authentication protocols, reducing the user's burden to simply presenting their biometric or NFC card while the device handles the complex security processes autonomously.
3Productivity
If RFID/NFC cards are used as identifiers, then authentication speed is improved, but security is weakened due to potential identifier duplication
Solution Approach 1:
The system replaces the simple mechanical/electromagnetic identification of RFID/NFC cards with cryptographic verification. Instead of relying on the uniqueness of card identifiers alone, the authenticator generates and verifies cryptographic signatures based on private keys that are cryptographically bound to the card's identifier. This substitution transforms the weak mechanical identification system into a strong cryptographic authentication system that maintains the speed of card reading while eliminating security vulnerabilities.
Solution Approach 2:
The system changes the authentication parameter from relying on the card identifier itself to relying on cryptographic credentials derived from that identifier. The card's unique ID serves only as a seed for generating cryptographic key pairs, and the actual authentication is performed using digital signatures and public key verification. This parameter transformation maintains the fast card-reading capability while elevating security to cryptographic levels.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Enables secure, personalized, and efficient user authentication on shared devices by leveraging unique identifiers, allowing seamless access to applications and services while maintaining robust security measures.
Implementation Method 1
a card reader interface configured to extract a unique identifier from an RFID/NFC card
Implementation Method 2
a Bluetooth Low Energy module configured to transmit the unique identifier to a mobile device in proximity to the card reader
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Systems and methods for secure and efficient user authentication on shared mobile devices, such as smartphones and tablets. This solution leverages the capabilities of RFID/NFC cards, access cards, and biometric sensors to establish seamless and personalized user authentication. An authenticator application communicates with a remote authentication service to either register passkeys locally for platform-wide use or forward authentication requests for remote processing, depending on configuration. The authenticator application orchestrates communication between the user, mobile device, and authentication service, creating a secure framework for various applications. Upon successful authentication, the system transforms the mobile device into a platform authenticator, making passkeys available across native apps and browsers. This system enhances security by integrating user identifiers with hosted authenticators that are securely managed by the authentication service. By tapping NFC-enabled cards or utilizing a bridge device for data extraction, users can seamlessly engage with the shared mobile device environment, benefitting from robust security measures associated with FIDO authentication. The system encompasses the bridge device, which serves as an intermediary for data transmission, efficiently communicating between RFID/NFC devices and mobile devices using Bluetooth Low Energy (BLE) technology. Biometric authentication operates similarly to RFID/NFC-based methods, where user identity is verified through an authentication service, and passkey support is provided for that specific user. The authentication service hosts user authenticators and passkeys in a secure, transportable format, configurable to be fetched to shared mobile devices or handled remotely. This system allows adaptable FIDO2/WebAuthn security protocols across multiple devices, enhancing user convenience while ensuring system integrity and security in shared device scenarios.