User-Specific Key Derivation for Secondary System Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for controlling user access to secondary systems pose security risks, particularly for administrators, as they are susceptible to false suspicion during security incidents and lack robust authentication mechanisms.
Innovation Solution
A method where a primary system receives and authenticates user credentials, generates a user-specific key, and uses it to derive secondary authentication information for access to a secondary system, eliminating the need for a single general key and reducing administrator suspicion by ensuring only current user-specific keys are accessible.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single general key is used for authentication to secondary systems, then access control is simplified, but security risks increase and administrators become susceptible to false suspicion
Solution Approach 1:
The patent segments the authentication mechanism by generating unique user-specific keys for each user instead of using a single general key. This segmentation isolates authentication credentials per user, so that compromise of one user's credentials does not affect others, thereby maintaining security reliability while preserving operational simplicity through automated key management.
Solution Approach 2:
The patent applies local quality by making authentication credentials user-specific rather than uniform. Each user receives a uniquely derived authentication key tailored to their identity, which enhances security by preventing widespread compromise while the centralized derivation process maintains operational simplicity.
2Reliability
If user-specific keys are generated and stored for each user, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-generating and storing user-specific keys in a secure credential store during user registration or system initialization. This preliminary setup eliminates the need for complex real-time key generation during authentication, thereby enhancing security through pre-established unique credentials while minimizing system complexity by performing the complex operation in advance.
Solution Approach 2:
The patent introduces an intermediary credential store that securely holds user-specific keys. This intermediary component simplifies the authentication process by mediating between users and the authentication system, allowing secure storage and retrieval of complex cryptographic materials without increasing operational complexity at other system points.
3Loss of information
If administrators have access to authentication keys for auditing purposes, then auditability is improved, but security risks increase due to potential key compromise
Solution Approach 1:
The patent segments authentication credentials into user-specific keys that are individually stored and managed. This segmentation allows auditability by enabling tracking of individual user authentications while preventing security risks associated with key exposure, as each user's key is isolated and cannot be used to authenticate other users or gain administrative access.
Solution Approach 2:
The patent applies local quality by making each authentication key uniquely tied to a specific user's identity and access rights. This user-specific localization enables precise auditing of individual user actions while minimizing security risks, as compromise of one user's key does not expose other users' credentials or administrative access paths.
Data Source
AI summary
A method for controlling access of a user to a secondary system. A primary system receives, from a user system connected to the secondary system, first authentication information comprising an encryption of a random string. The encryption of the random string is a user-specific key. Second authentication information is generated from protected secondary authentication data stored in the primary system. Generation of the second authentication information includes applying the user-specific key to the protected secondary authentication data to generate the second authentication information. The second authentication information is provided to the secondary system to enable access of the user to the secondary system.