Trusted Execution Environment for 2FA Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor authentication methods, such as two-factor authentication (2FA), create friction and inefficiencies in user experience due to the need for additional verification steps, such as entering one-time passwords or using biometrics, which can delay access to secure systems.
Innovation Solution
A method that provisions a subscriber device to authenticate using a cloud authentication service, where a trusted application on the device generates and manages public and private keys, allowing for encrypted transactions and user consent prompts, enhancing the 2FA process with a seamless and secure authentication mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional two-factor authentication methods (OTP via messaging, biometric scanning) are used, then security is improved by requiring additional verification, but user experience deteriorates due to friction and delays in accessing the secure system
Solution Approach 1:
The system performs preliminary actions by pre-provisioning the subscriber device with cryptographic credentials and establishing trust relationships before authentication is needed. The device identity and public key are registered with the CAS in advance, and the trusted application is pre-configured with encryption keys, so that when authentication is required, the device can immediately prove its identity without requiring user interaction for key exchange or credential verification
Solution Approach 2:
The subscriber device performs self-service authentication by using its own private key to sign authentication requests and by automatically managing the verification process through the trusted application. The device independently proves its identity to the CAS without requiring manual intervention, OTP entry, or biometric scanning, thereby eliminating the friction associated with traditional 2FA methods while maintaining strong security
2Ease of operation
If public key infrastructure is implemented for seamless authentication, then user experience is improved by reducing friction, but device complexity increases due to cryptographic key management and trusted execution environment requirements
Solution Approach 1:
The system extracts the complex cryptographic operations and key management functions into a dedicated trusted execution environment (TEE) on the subscriber device. By isolating these complex functions in a secure, specialized environment, the main operating system and applications can interact with the authentication system through simple, standardized interfaces without needing to understand or manage the underlying cryptographic complexity
Solution Approach 2:
The trusted application acts as an intermediary between the simple user interface layer and the complex cryptographic infrastructure. It manages the interaction between the application, the TEE, and the CAS, handling key management, signing operations, and protocol implementation, thereby shielding applications and users from the complexity of public key infrastructure while enabling seamless authentication
Data Source
AI summary
This invention pertains to a method for provisioning and implementing two-factor authentication (2FA) for enterprise services. The system securely establishes a trusted identity for a subscriber device using an immutable hardware key and public/private key sets. The device's identity is verified by an Original Equipment Manufacturer (OEM) cloud service. The method includes generating unique transaction nonces for each 2FA request, securing private keys within a Trusted Execution Environment (TEE), and employing a cloud wallet service to store keys. The subscriber device interacts with the system, decrypting and re-encrypting transaction nonces using corresponding keys. This process enables secure transaction from enterprise applications. The system also integrates user consent into the 2FA process, displaying a prompt to approve or deny authentication. This technology enhances security in enterprise services, prioritizing user consent and secure data transfer.