Subject Identifier Authentication for Multi-Device Key Portability

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing user authentication methods using public/private key pairs bound to specific devices or cloud platforms are insecure, especially for regulated industries like healthcare and finance, as they fail to ensure identity verification and key possession, making them vulnerable to phishing and unauthorized access.

Innovation Solution

Implementing an identity broker system that generates decentralized identifiers (DIDs) and associated documents, enabling secure pass key authentication (SPK) and single sign-on, ensuring identity-bound access to sensitive information without relying on platform providers, and allowing secure key sharing across devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If device bound private keys are used for authentication, then security against phishing attacks is improved, but key propagation to multiple devices and account recovery become difficult

Engineering Contradiction:

Improveauthentication securityVSAvoiddevice portability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The authentication system is segmented into multiple independent components: the relying party domain bound private key for security, the subject identifier for identity representation, and the subject identifier document for credential verification. This segmentation allows the security-critical key to remain device-bound while enabling portable identity verification through the separate subject identifier.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The subject identifier acts as an intermediary between the user's identity and the authentication system. Instead of directly propagating the private key across devices, the subject identifier serves as a portable reference that can be verified by the relying party without exposing the device-bound key, thus enabling account recovery and multi-device support while maintaining security.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If cloud bound private keys are used for authentication, then account recovery and multi-device support are improved, but security and control over credentials are reduced

Engineering Contradiction:

Improveaccount recoveryVSAvoidauthentication security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

Instead of storing the private key in the cloud for easy access, the system inverts the approach by storing only the subject identifier (a public reference) in the cloud and keeping the actual private key device-bound. This inversion maintains the benefits of cloud-based account management while preserving the security advantages of device-bound keys.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

Different components of the authentication system have different location properties: the subject identifier is cloud-stored for portability and account recovery, while the private key remains locally device-bound for security. This local quality differentiation allows each component to be positioned optimally for its specific function.

Inventive Principle:

Principle #3Local quality

3Ease of operation

If platform provider managed keys are used, then ease of operation is improved, but control over credentials and compliance with regulations are reduced

Engineering Contradiction:

Improveauthentication convenienceVSAvoidcredential control

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The relying party performs self-service by generating and managing its own domain bound private keys and subject identifiers without relying on platform provider key management. This self-service approach maintains operational simplicity while ensuring full control over credentials and compliance with regulatory requirements for sensitive data.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS20250294019A1Systems and methods for user authentication using subject identifier and/or subject identifier documents

Publication Date: 2025.09.18 AETNA INC

AI summary

In some instances, a method is provided. The method comprises: based on a content request for content from a user device associated with a user, generating a subject identifier for the user, wherein the subject identifier comprises a plurality of elements, wherein at least one of the plurality of elements comprises a subject identifier fragment indicating a unique identifier string for the user; based on generating the subject identifier for the user, providing, to the user device, a request to enroll in secure pass key (SPK) authentication; based on receiving user input indicating approval to enroll in the SPK authentication, generating a SPK for the user based on the subject identifier fragment from the subject identifier; and providing the SPK to the user device, wherein the user device accesses the requested content based on using the SPK.