Three-Factor Authentication Protocol for Mobile Device Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication methods for mobile devices lack robustness in verifying user identity, as they often rely on a single factor, such as a password or biometric, which can be vulnerable to false rejects or accepts, and do not effectively integrate device-specific credentials for secure registration and authentication.
Innovation Solution
A three-factor authentication protocol that combines a biometric credential, a device-specific credential (such as a cryptographic hash of device data), and a location-based credential, using symmetric and asymmetric keys for encryption and decryption, with a server-validated signature process to ensure secure device registration and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two-factor authentication is used with a single factor (password or biometric), then the authentication process is simple to implement, but the security robustness is insufficient due to vulnerability to false rejects or accepts
Solution Approach 1:
The authentication system is segmented into three distinct credential factors: device-specific credential (stored in secure element), location-based credential (GPS coordinates), and transaction-based credential (one-time code). Each factor is verified independently by the server, allowing the system to achieve high security robustness through multiple verification points while maintaining implementation simplicity through modular architecture
Solution Approach 2:
The server acts as an intermediary that coordinates the verification of all three credential factors. It receives the device fingerprint, validates location coordinates, generates one-time codes, and performs cryptographic verification. This intermediary approach allows complex multi-factor verification to be managed centrally, reducing the complexity burden on the mobile device itself
2Reliability
If device-specific credentials are integrated into the authentication protocol, then the authentication reliability is improved, but the device complexity increases due to multiple verification steps
Solution Approach 1:
The device-specific credential is pre-provisioned in the secure element during device manufacturing or initial setup. The server pre-generates and stores the expected device fingerprint and location coordinates before authentication is needed. This preliminary preparation allows the actual authentication to proceed with simple comparison operations rather than complex real-time computation
Solution Approach 2:
The mobile device autonomously constructs the authentication request by gathering its own device fingerprint from the secure element, retrieving current location coordinates, and generating a one-time code. It then transmits these credentials to the server for verification. This self-service approach reduces the complexity burden on the server and streamlines the authentication flow
3Measurement precision
If multi-layered verification with device-specific data and location-based restrictions is implemented, then the false reject and accept rates are reduced, but the authentication process requires more verification steps
Solution Approach 1:
The system replaces manual verification of device identity and location with automated cryptographic and geographic comparisons. The server automatically compares the transmitted device fingerprint against the stored expected fingerprint, validates location coordinates against registered addresses, and verifies one-time codes through cryptographic validation. This substitution of mechanical/manual verification with automated electronic validation maintains high precision while minimizing time loss
Data Source
AI summary
Systems and methods for device registration and authentication are disclosed. In one embodiment, a method for authentication of a device may include (1) receiving, at a mobile device, a first credential; (2) transmitting, over a network, the first credential to a server; (3) receiving, from the server, a first key and a first value, the first value comprising a receipt for the first credential; (4) receiving, at the mobile device, a data entry for a second credential; (5) generating, by a processor, a second key from the data entry; (6) retrieving, by the mobile device, a third credential using the first key and the second key; (7) signing, by the mobile device, the first value with the third credential; and (8) transmitting, over the network, the signed third value to the server.