User Selected Key Authentication System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud platform authentication methods, such as username-password pairs, are cumbersome for users and vulnerable to security risks, including identity theft and complex password management.
Innovation Solution
Implementing a user-selected key authentication system that uses unique identifiers, which are randomly generated and displayed on multiple devices, allowing users to verify and select a matching identifier across devices, along with a user-specific identifier like a PIN or biometric input, to authenticate access without storing passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username-password authentication is used, then user access control is achieved, but security risk increases due to password compromise and identity theft
Solution Approach 1:
The patent extracts the password from the authentication process entirely. Instead of using passwords, the system uses public key cryptography where the user's public key serves as the authentication credential. This removes the vulnerable password component while maintaining authentication functionality.
Solution Approach 2:
The patent introduces a key pair generation service and certificate authority as intermediaries. These intermediaries generate cryptographic key pairs for users and manage the authentication process, replacing the direct username-password authentication mechanism with a more secure cryptographic protocol.
2Reliability
If complex passwords are used, then security is improved, but ease of operation deteriorates due to difficulty in remembering and managing passwords
Solution Approach 1:
The system allows users to automatically generate their own cryptographic key pairs through the key pair generation service. Users don't need to manually create or remember complex passwords; the cryptographic system handles security autonomously while providing a simple user interface for authentication.
Solution Approach 2:
The patent replaces the mechanical password entry and verification system with cryptographic operations. Instead of users typing and systems storing passwords, the system uses public key cryptography and digital signatures, which are computationally based rather than mechanically based.
3Ease of operation
If passwords are stored in the cloud platform, then user authentication is enabled, but security vulnerability increases due to potential data breaches
Solution Approach 1:
The patent extracts the sensitive authentication data (passwords) from the cloud platform's storage. Instead of storing passwords on servers, the system uses public key cryptography where only public keys and authentication tokens are stored, eliminating the risk of password database breaches.
Solution Approach 2:
The patent changes the fundamental parameter of what is stored for authentication. Instead of storing secret passwords, the system stores public keys and session tokens that are mathematically derived from private keys that never leave the user's device, fundamentally changing the storage requirements and security model.
4Reliability
If traditional authentication methods are used, then user verification is achieved, but device complexity increases due to password management infrastructure
Solution Approach 1:
The patent creates a universal authentication mechanism using public key cryptography that can be implemented across multiple devices and platforms. The same cryptographic principles work on mobile devices, desktops, and servers, reducing the need for device-specific authentication infrastructure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and devices for user authentication are described. A user may attempt an authentication procedure when accessing an application or cloud platform. When the user requests access to the application or cloud platform, a server may determine one or more unique identifiers to display at a first application for the user, and the user may select one of the unique identifiers. The server may then display unique identifiers (e.g., in some cases, the same unique identifiers) at a second application associated with the user. The user may verify that the selected unique identifier is displayed on the second application, and may select the same unique identifier in the second application. Additionally, the user may input a user-specific identifier to confirm their identity. The server may authenticate the user's identity if the user selected matching unique identifiers, and if the user-specific identifier matches an expected identifier for the user.