Passwordless Logon with TPM-Bound Nonce and Biometric Proximity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-based authentication methods are susceptible to cybersecurity attacks, such as AITM attacks, and WebAuthn adoption is low due to inconsistent security settings, leading to insecure and cumbersome user experiences.
Innovation Solution
Implementing an Operating System Logon Passwordless (OSPWL) system that combines proximity checking, biometric push approval, and hardware-bound strong encryption to provide a secure passwordless authentication, using a trusted platform module (TPM) for encryption and a shared nonce secret to authenticate users without typing a password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password-based authentication is used, then users can access systems and services, but the system becomes susceptible to cybersecurity attacks such as AITM attacks, phishing, and credential theft
Solution Approach 1:
The patent replaces the mechanical password-based authentication system with a biometric-based authentication system. Instead of relying on users to remember and input passwords (mechanical interaction), the system uses biometric characteristics (fingerprint, facial recognition, iris scan) to automatically verify user identity, thereby eliminating susceptibility to phishing and credential theft attacks
Solution Approach 2:
The patent introduces a trusted platform module (TPM) and secure enclave as intermediaries between the user and the system. These components securely store biometric templates and cryptographic keys, performing authentication operations in isolation from the main system to prevent attacks that would otherwise compromise credentials or session tokens
Solution Approach 3:
The patent adds proximity checking as an additional dimension to authentication. By requiring the user's device to be physically near the system (via Bluetooth or NFC proximity detection), the system creates a spatial dimension that AITM attackers cannot bypass, since they cannot physically approach the device to perform the authentication
2Ease of operation
If WebAuthn protocol is implemented, then passwordless authentication is enabled, but adoption is low due to inconsistent security settings across different websites and browsers
Solution Approach 1:
The patent creates a universal authentication interface that works across multiple websites and platforms. By implementing a standardized web browser extension that communicates with a cross-platform authenticator application, the system provides consistent passwordless authentication experience regardless of the website or browser being used, eliminating the fragmentation problem of WebAuthn
Solution Approach 2:
The patent introduces a web browser extension as an intermediary layer between the web application and the authenticator application. This extension handles the complex cryptographic operations and protocol negotiations, presenting a simplified interface to both the user and the web application, thereby abstracting away the complexity of security settings
3Reliability
If multi-factor authentication is implemented, then security against traditional phishing is improved, but user experience becomes more complex and time-consuming
Solution Approach 1:
The patent performs proximity checking and biometric verification in advance, before the actual authentication transaction. By pre-establishing that the user's device is near the system and pre-verifying biometric characteristics, the system can complete authentication instantly when needed, eliminating the time-consuming sequential verification process of traditional MFA
Solution Approach 2:
The patent merges multiple authentication factors (proximity detection, biometric verification, and cryptographic authentication) into a single unified action. Instead of requiring users to complete separate steps for each factor, the system combines them into one seamless authentication flow that verifies all factors simultaneously, reducing both time and complexity
Data Source
AI summary
In one embodiment, a method receives a secret and a passwordless login request using a credential provider of the client device. The method pairs the credential provider of the client device with a trusted platform module (TPM) associated with a computing device. The method encrypts, using the TPM of the computing device, the secret with a hardware-bound key associated with the computing device. The method receives, from the client device, a push notification associated with the passwordless login request. The method obtains, from the client device, biometric authentication data and a nonce encrypted with a public key. The method validates a proximity of the biometric authentication data and determine a decrypted nonce by decrypting the nonce using a private key associated with the client device. The method validates the decrypted nonce with the secret. In response to determining the decrypted nonce is valid, the method approves the passwordless login request.