Two-Element Mobile Authentication with Challenge-Response Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile devices face challenges in implementing a uniformly high security standard for user authentication across different manufacturers, particularly when transitioning between low and high security requirements, and there is a need for secure binding of the user to both the device and application programs.
Innovation Solution
A method utilizing two independent security elements on a mobile terminal, where a first security element associated with the operating system and a second security element associated with the application program, execute a challenge-response procedure to authenticate the user, ensuring cryptographic security and binding through cryptographic key sharing and challenge-response methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single security element is used for authentication, then device complexity is reduced, but authentication security and manufacturer independence are compromised
Solution Approach 1:
The authentication system is divided into two independent security elements: a first security element associated with the operating system and a second security element associated with the application program. Each security element performs a specific authentication function, with the first verifying user credentials and the second verifying application legitimacy. This segmentation allows high-security authentication without requiring a single complex security system, as each element can be optimized for its specific purpose.
2Adaptability or versatility
If security elements are tightly coupled to specific manufacturers, then implementation is simplified, but adaptability across different manufacturers is reduced
Solution Approach 1:
The second security element is designed to be manufacturer-independent and can verify authentication from any first security element. The challenge-response protocol and cryptographic verification methods are standardized, allowing the second security element to work with different manufacturers' first security elements. This universality enables the system to be deployed across multiple manufacturers without requiring manufacturer-specific implementations, achieving adaptability while maintaining manageable complexity through standardization.
3Reliability
If cryptographic key sharing is implemented between security elements, then authentication binding is strengthened, but security vulnerability increases
Solution Approach 1:
The system uses asymmetric cryptography where the first security element holds a private key and the second security element holds a public key for verification. The cryptographic binding is established through asymmetric key pairs, where the private key never leaves the first security element and the public key is used by the second security element for verification. This asymmetry strengthens authentication binding while minimizing security vulnerabilities, as the sensitive private key remains protected in its original security element.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for authenticating a user to an application program (108) installed on a mobile device (100). The device (100) comprises a first security element (110) associated with an operating system (106) and a second security element (112) independent of the first security element (110) with a security applet (114) associated with the application program (108).The procedure comprises: • in response to an authentication request from the application program (108), authentication of the user by the operating system (106) using an authentication sensor (118) of the terminal device (100) and the first security element (110), • execution of a challenge-response procedure between the first security element (110) and the security applet (114) of the second security element (112), wherein successful execution of the challenge-response procedure confirms successful authentication of the user by the operating system (106), • in response to successful execution of the challenge-response procedure, confirmation of the successful authentication of the user to the application program (108) by the security applet (114).