Authentication Token Signing Without Server-Stored Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current online identification systems rely on less secure methods such as proprietary camera-based systems, which lack robust security and are vulnerable to scalable attacks.
Innovation Solution
A method and system utilizing a secure server that enrolls individuals using a user device, creates a public key and private key pair, associates a trusted identifier with a database index to form an authentication token, signs the token, and sends it to the user device while deleting the identifier from the server, ensuring high security and resistance to attacks by not storing personal data on the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If trusted identifiers are stored on the secure server for authentication, then authentication functionality is enabled, but security is compromised and the system becomes vulnerable to scalable attacks
Solution Approach 1:
The trusted identifier is extracted from the secure server and stored instead on the user device. During enrollment, the server creates an authentication token containing the trusted identifier, signs it with its private key, and sends it to the user device. The server then deletes the trusted identifier from its database. This extraction eliminates the security vulnerability while maintaining authentication functionality through the signed token.
Solution Approach 2:
The server performs preliminary actions by creating and signing the authentication token before the actual authentication process. The trusted identifier is associated with database indexes and signed with the server's private key during enrollment, creating a pre-authenticated token that the user device stores. This preliminary signing provides security without requiring the server to store the identifier.
2Loss of information
If personal data is stored on the secure server, then user identification is enabled, but the system becomes vulnerable to data breaches and attacks
Solution Approach 1:
Personal data in the form of trusted identifiers is extracted from the secure server's storage. Instead of maintaining a database of personal identifiers, the server only stores signed authentication tokens that reference database indexes. The actual trusted identifier resides on the user device, eliminating the target for data breaches while preserving identification capability through the token verification process.
3Productivity
If the secure server stores and processes trusted identifiers, then authentication processing is centralized, but the system becomes a single point of failure
Solution Approach 1:
The authentication system is segmented into distributed components. The trusted identifier resides on the user device, the authentication token is signed by the server and stored on the device, and verification can be performed by any party with the server's public key. This segmentation distributes trust and eliminates the single point of failure, as the server cannot be compromised to extract identifiers, and the user device holds the critical authentication data independently.
Data Source
AI summary
The present disclosure relates to a method of enrolling an individual at a secure server and subsequently authenticating and identifying the individual at an authenticating party using an authentication token created during the enrolment and a secure server performing the method. The method comprises engaging, via a user device, in an enrolment process with the individual, registering the user device by receiving a public key, the public key being created by the user device along with a private key corresponding to the public key, acquiring a trusted identifier of the individual, associating the acquired trusted identifier of the individual with at least one database index to create an authentication token, the database index being utilized for look-up at the secure server, signing the authentication token, and sending the signed authentication token to the user device, while deleting the acquired trusted identifier at the secure server.