Wearable Device Secure Identity Token Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulties in managing multiple credentials for accessing secure remote network locations, leading to potential security risks when credentials are not configured, especially in enterprise settings where apps often require unique usernames, passwords, and tokens like JWT or SAML.
Innovation Solution
A method involving a personal computing device performing a secure handshake with an identity provider, receiving a temporary identity token, encrypting it using a public key, and transmitting it to a paired wearable device for storage, while the private key remains on the computing device, ensuring secure authentication and access to secure network locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple credentials are configured for accessing secure remote network locations, then security is improved, but device complexity and ease of operation deteriorate due to the difficulty of managing different credentials
Solution Approach 1:
The patent extracts the credential management burden from the user by implementing automatic authentication mechanisms. The system automatically retrieves and uses credentials without requiring users to manually input or manage multiple credentials, thus maintaining security while dramatically improving ease of operation.
Solution Approach 2:
The authentication system performs self-service by automatically managing credential retrieval and authentication processes. The device autonomously handles credential verification and access management without requiring user intervention, resolving the contradiction between security and operational simplicity.
2Ease of operation
If device credentials are not configured to simplify operation, then ease of operation improves, but security deteriorates as devices can be used by anyone
Solution Approach 1:
The patent introduces biometric authentication (fingerprint reader) as an intermediary between the user and device access. This intermediary mechanism provides secure authentication that is as convenient as physical presence, allowing easy operation while maintaining strong security through biological verification.
3Ease of operation
If credentials are stored on the device for convenient access, then ease of operation improves, but security deteriorates due to potential unauthorized access if the device is lost or stolen
Solution Approach 1:
The patent segments authentication factors across multiple components: biometric data stored securely in hardware, credential information managed by the operating system, and authentication logic distributed between hardware and software layers. This segmentation ensures that compromise of one component does not lead to complete system compromise.
Solution Approach 2:
The system implements beforehand cushioning through secure hardware enclaves and encrypted storage of credentials. These security measures are pre-configured to protect against potential theft or loss, providing a safety buffer that prevents unauthorized access even if the device is compromised.
Data Source
AI summary
Aspects of the embodiments include performing, by a personal computing device, a secure handshake with a secure server accessible through an identity provider to log into the secure server. A temporary identity (TID) token can be received at the personal computing device a from an identity provider system over a telecommunications network. The TID token can be encrypted using a cryptographic key stored in a hardware storage element of the personal computing device. The encrypted TID token can be transmitted to a connected wearable device across a Bluetooth connection or other connection protocol. When a user wishes to log into a network location accessible through the identity provider, the wearable device can provide the encrypted TID token to the computing device. The personal computing device can decrypt the encrypted TID token and use the decrypted TID to access the network location.