Web3 Multi-Factor Authentication Using Off-Chain Second Factors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication (2FA) mechanisms cannot be adopted in Web3 due to the need for secret information to be publicly available in the blockchain, and existing solutions like U.S. Ser. No. 11/025,431B2 and U.S. Ser. No. 11/257,078B2 have security vulnerabilities or limitations.
Innovation Solution
A multi-factor authentication method for Web3 services that uses off-chain data, associating a user's public key with a user terminal through a multi-factor authentication provider, where the second factor is validated using off-chain data such as SMS or other means, ensuring the user's identity is preserved and enhancing security by separating authentication keys and factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secret information is stored in the blockchain for 2FA, then authentication can be performed, but user identity and security are compromised due to public accessibility
Solution Approach 1:
The patent extracts the secret information (second authentication factor) from the blockchain environment and stores it off-chain in a secure element or hardware token. Only the verification capability remains on-chain through a smart contract that checks cryptographic proofs without exposing the actual secret. This resolves the contradiction by removing the harmful public accessibility while maintaining authentication functionality.
Solution Approach 2:
The patent introduces a cryptographic proof mechanism as an intermediary between the off-chain secret and the on-chain verification. The smart contract verifies cryptographic signatures or zero-knowledge proofs generated by the user's device, allowing authentication without the contract ever accessing or storing the actual secret information. This mediator enables secure verification while preserving user identity privacy.
2Reliability
If traditional 2FA is implemented in Web3, then security is improved, but it cannot be adopted due to blockchain's public nature
Solution Approach 1:
The patent segments the authentication system into distinct components: cryptographic key generation and secret storage occur off-chain in user-controlled devices, while only verification logic resides on-chain in smart contracts. This segmentation allows traditional 2FA security mechanisms to function in the Web3 environment by separating the incompatible elements (secret storage) from the compatible ones (verification).
Solution Approach 2:
The patent replaces the mechanical system of storing secrets directly in blockchain storage with a cryptographic substitution model. Instead of storing authentication factors in blockchain databases, the system uses cryptographic signatures, public-key infrastructure, and zero-knowledge proofs to enable verification without storage. This substitution makes 2FA compatible with blockchain's public nature.
3Reliability
If private key is lost, then access to Web3 assets is lost permanently, but key recovery is needed for user convenience
Solution Approach 1:
The patent implements preliminary action through social recovery mechanisms where users pre-configure trusted contacts or recovery agents during account setup. If a private key is lost, these pre-configured contacts can collectively sign a recovery transaction through a smart contract, restoring access without requiring the original private key. This preliminary configuration enables convenient recovery while maintaining security through multi-party authorization.
Solution Approach 2:
The patent implements a controlled key recovery mechanism where the original private key is effectively discarded (lost) but the account state can be recovered through cryptographic proofs and social recovery protocols. The smart contract verifies that the recovering party has legitimate authorization through pre-configured recovery conditions, allowing the user to generate a new private key and regain access to assets without the original key.
Data Source
AI summary
A method and system for multi-factor authenticating users in Web3 services includes a multi-factor authentication (e.g., 2FA) provider configured to validate that an end-user owns a public key in a blockchain based on a cryptocurrency or a NFT transference, the public key used as a first factor for the authentication. The authentication provider interacts with a smart contract to perform the multi-factor authentication in an operation in a smart contract by using off-chain data as the other factor(s) required for the multi-factor authentication. The off-chain data are received in a user terminal, e.g., a smartphone via SMS or a mobile application, associated with the account created in the authentication provider. The authentication result is read by each node executing the smart contract and, when a consensus is reached among nodes, a new block representing the result is generated in the blockchain.