Zero-Knowledge Multi-Factor Authentication System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional password-based authentication systems are flawed due to reliance on password length and randomness, leading to insecure practices such as using short or reused passwords, and they have a single point of failure, compromising multiple accounts if breached.
Innovation Solution
A zero-knowledge proof-based multi-factor authentication system that uses credentials and device registration data for unique device identification, generating device key fragments and public keys, and performing authentication rounds without revealing sensitive information, ensuring secure access without password storage on devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional password-based authentication is used, then ease of operation is improved, but security is worsened due to reliance on password length and randomness leading to insecure practices
Solution Approach 1:
The authentication system segments the authentication factors into multiple independent components: device registration data, credentials, and biometric information. Each component is processed and verified separately through the authentication protocol, so that compromise of one factor does not lead to complete system failure. This segmentation resolves the contradiction by maintaining ease of operation through automated multi-factor verification while improving security through distributed authentication factors.
Solution Approach 2:
The system introduces an intermediary authentication protocol that acts as a mediator between the user and the verification system. This protocol uses zero-knowledge proofs and secure multi-party computation to verify credentials without exposing sensitive information. The intermediary layer maintains ease of operation by automating the complex verification process while significantly improving security by preventing password exposure and reducing reliance on user-chosen passwords.
2Ease of operation
If passwords are stored in a centralized database, then ease of operation is improved, but security is worsened due to single point of failure compromising multiple accounts
Solution Approach 1:
The authentication system eliminates centralized password storage by segmenting authentication credentials across multiple independent components: device-specific registration data stored locally on user devices, credentials stored securely in enclave environments, and biometric information stored in secure hardware. This segmentation removes the single point of failure while maintaining ease of operation through automated multi-factor authentication that combines these distributed credentials.
Solution Approach 2:
The system extracts and removes passwords entirely from the authentication process. Instead of storing and transmitting passwords in centralized databases, the system uses device registration data that is never stored centrally, credentials that are verified through zero-knowledge proofs without exposure, and biometric information that remains in secure hardware. This extraction of passwords eliminates the vulnerability to centralized breaches while maintaining user-friendly authentication.
3Device complexity
If users are relied upon to maintain device security and cyber hygiene, then device complexity is reduced, but security is worsened due to user errors and malicious software
Solution Approach 1:
The authentication system implements self-service security mechanisms that automatically protect against user errors and malicious software. The secure enclave environment automatically manages cryptographic keys and credentials without user intervention. Device registration data is automatically verified through the authentication protocol. Biometric authentication is automatically processed by secure hardware. These self-service mechanisms maintain simple device architecture while improving security by removing reliance on user cyber hygiene.
Solution Approach 2:
The system introduces an intermediary secure enclave environment that acts as a mediator between the user device and the authentication server. This intermediary layer provides automatic security functions including cryptographic key management, credential verification through zero-knowledge proofs, and protection against malicious software. The intermediary maintains device simplicity by encapsulating complex security operations while significantly improving reliability by preventing user errors and attacks.
Data Source
AI summary
An authentication method of a prover by a verifier includes: performing at least once, an enrollment process by an enrollment center computer; and subsequent to performing the enrollment process, performing an on demand authentication process including: receiving at a verifier computer from the prover, a prover authentication request sent from the prover computer device which includes the prover identity and a preferred ZKP protocol identifier; looking up a prover's public key in the database via the identity; the verifier sending a selected ZKP protocol identifier to the prover computer device; commencing a round of authentication by receiving a commitment generated according to the selected ZKP protocol; and repeating the step of commencing a round of authentication until the verifier computer accepts or rejects the prover's identity. A zkMFA method of authentication and an authentication system for authenticating a prover by a verifier are also described.