Two-factor authentication with public key infrastructure

A method of implementing two-factor authentication for an enterprise service, the method comprising the steps of:

• a. receiving from an enterprise application by an enterprise service a request to proceed with a sensitive transaction;
• b. forwarding a request for 2FA from the enterprise services to a CAS;
• c. generating, at the CAS, a transaction nonce for the request for 2FA;
• d. retrieving, by the CAS, from a cloud wallet service, a public key for the subscriber device;
• e. encrypting, by the CAS, the transaction nonce with the public key for the subscriber device;
• f. poking, by the CAS, the subscriber device for 2FA using the encrypted transaction nonce;
• g. decrypting, by the trusted application on the subscriber device, the transaction nonce using a private key for the subscriber device securely stored in a trusted execution environment (TEE) on the subscriber device, the private key a corresponding pair to the public key previously used by the CAS to encrypt the transaction nonce;
• h. responsive to consent to the 2FA request at the subscriber device, re-encrypting the transaction nonce and response with a public key for the CAS;
• 1. sending the re-encrypted transaction nonce and response from the subscriber device back to the CAS;
• j. decrypting, at the CAS, the re-encrypted transaction nonce using a private key for the CAS that is a pair to the public key for the CAS used at the subscriber device to re-encrypt the transaction nonce;
• k. validating the decrypted nonce at the CAS as a valid result and forwarding the valid result from the CAS to the enterprise service;
• and
• 1. sending the valid result from the enterprise service to the enterprise application whereby the enterprise application proceeds with the sensitive transaction as it has been validated, thereby enhancing user control over the 2FA.