Split Knowledge MFA via Backend Token Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise environments, web-based accounts lack sufficient security as a single individual has access to all information needed to access the account, increasing the risk of breach, and existing multi-factor authentication methods do not effectively mitigate this risk.
Innovation Solution
A system and method that separates the knowledge required to access a web-based account by having a root user hold the account password and a second user hold the TOTP tokens, with secure communication between a mobile application and a backend system to facilitate the generation and transmission of TOTP tokens, ensuring that both users must collaborate for access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single user holds all account access information (password and MFA token), then account setup is simple and fast, but security is weakened because one individual has a 'key to the kingdom'
Solution Approach 1:
The patent segments account access information into two separate parts: the password held by the account holder and the MFA token held by a different user. This segmentation ensures that no single individual has complete access to the account, thereby improving security while maintaining a streamlined setup process through automated token delivery.
2Reliability
If a single user holds all account access information, then the account setup process is efficient, but the risk of breach by any one individual increases
Solution Approach 1:
The system configuration is segmented into distinct components: password management by the account holder, MFA token generation by a separate user, and automated delivery through the backend system. This segmentation mitigates breach risk while avoiding excessive complexity through standardized automated processes.
Solution Approach 2:
The patent introduces a backend system as an intermediary that automatically manages the delivery of MFA tokens to the appropriate users. This intermediary handles the complex coordination between password holders and token holders, reducing the perceived system complexity for end users while maintaining strong security through enforced separation of access credentials.
3Reliability
If two users must physically or virtually come together to enable MFA, then security is enhanced through split knowledge, but expense, aggravation and delay are added to the account setup process
Solution Approach 1:
The backend system acts as an intermediary that automatically coordinates between the account holder and the MFA token holder. Instead of requiring physical or virtual meetings, the system automatically delivers tokens to the appropriate user, maintaining split knowledge security while eliminating the time loss and aggravation associated with manual coordination.
Solution Approach 2:
The system performs preliminary actions by pre-configuring the MFA token delivery process. When an account is created, the system proactively identifies the appropriate token holder and initiates token delivery automatically, rather than waiting for users to coordinate their meeting. This preliminary automation maintains security through split knowledge while eliminating setup delays.
4Reliability
If manual coordination is required for MFA setup between two users, then security control is maintained, but productivity and efficiency of account provisioning decrease
Solution Approach 1:
The backend system serves as an automated intermediary that manages the entire MFA provisioning process. It coordinates between account holders and token holders, delivers tokens automatically, and tracks setup status. This maintains security control through enforced credential separation while dramatically improving productivity by eliminating manual coordination requirements.
Solution Approach 2:
The system enables self-service provisioning where the automated backend infrastructure handles the coordination and token delivery without requiring active user intervention for scheduling or communication. Account holders and token holders can complete setup independently through automated workflows, maintaining security control while maximizing provisioning efficiency.
Data Source
AI summary
Systems and methods for enabling multi-factor authentication for a web-based account. A first computing device and a second computing device are accessible to a first user. A backend system is accessible to a second user. The backend system communicates with the second computing device via a secure communication network. The first user creates a web-based account and receives a MFA initiation screen including secret information and a field for entering at least one TOTP token. The backend system has a TOTP token generator. The second computing device captures the secret information and transmits it to the backend system. The second user generates at least one TOTP token using the backend system and transmits the at least one TOTP token to the second computing device. The first user enters the at least one TOTP token into the first computing device. The account can then be validated and MFA enabled.