Trust Token Session Management for Wearable Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for secure resources are burdensome, requiring frequent reauthentication and relying on insecure cookies that are vulnerable to tampering, leading to user friction and security concerns.
Innovation Solution
A method using a trust token system where a server computer generates and maintains a trust token based on simultaneous authentication and user detection via a wearable device, such as a heartbeat, to extend access periods securely without the need for repeated authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple authentication methods are required for secure resources, then security is improved, but user convenience deteriorates due to frequent reauthentication
Solution Approach 1:
The system performs preliminary authentication and establishes a trust token that extends access beyond the immediate session. The trust token is generated after initial authentication and allows the user to access resources during an extended period without reauthentication, thus performing the security verification in advance rather than repeatedly.
Solution Approach 2:
The trust token acts as an intermediary between the authentication process and resource access. Instead of requiring direct reauthentication for each access attempt, the trust token mediates by providing a time-extended authorization that bridges the gap between initial authentication and subsequent resource requests.
2Ease of operation
If cookies are used to extend session access, then user convenience is improved by avoiding reauthentication, but security deteriorates due to vulnerability to tampering
Solution Approach 1:
The system changes the fundamental parameters of session management by replacing cookies with trust tokens that have different security characteristics. Trust tokens are cryptographically signed and can be validated without being stored in vulnerable locations, fundamentally changing how session state is maintained while extending access duration.
Solution Approach 2:
The patent replaces the mechanical cookie-based session extension system with a trust token system that uses cryptographic validation. Instead of relying on server-stored or client-stored cookies that can be tampered with, the system uses digitally signed tokens that provide both extended access and tamper resistance.
3Ease of operation
If access is prolonged using traditional session methods, then user friction is reduced, but security vulnerabilities increase due to exposed credentials
Solution Approach 1:
The system extracts the authentication credentials from the prolonged access mechanism. Instead of keeping credentials valid and exposed during an extended session, the system issues a trust token that provides access without requiring the actual credentials to remain valid or exposed, thus separating long-term access from credential validity.
Solution Approach 2:
The trust token functions as a disposable authorization object that provides extended access without the long-term security risks of persistent credentials. Each trust token is time-limited and can be revoked, providing a controlled way to extend access while maintaining the ability to invalidate authorization if needed.
Data Source
AI summary
A system and method are provided which include receiving, from a first application on a user device, an indication that a user has been authenticated and receiving, from a second application on the user device, an indication that the user is detected. The user device receives the indication that the user is detected from a wearable device on the user. Based on receiving the two indications within a time period, a trust token is generated or maintained for the user.