Authentication Script Authenticity via Authorization Gateway
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack a simple and efficient method for identity providers to ensure the authenticity and control of authentication script components, especially when a broker is present, as existing protocols like OAuth do not effectively verify the genuineness of script downloads and executions.
Innovation Solution
A 4-legs protocol involving the end-user, identity provider, resource owner, and broker, where an authorization gateway manages the download and execution of authentication scripts through a random token and contextual information verification, ensuring authenticity and integrity using mechanisms like Subresource Integrity (SRI) and session-bound tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OAuth protocol is used for authentication, then authentication capability is provided, but script authenticity verification is not possible when broker is present
Solution Approach 1:
The authentication process is segmented into distinct phases: script distribution phase, script execution phase, and verification phase. The verification phase is further segmented into downloading metadata, verifying integrity via SRI hashes, and validating tokens. This segmentation allows OAuth to handle authentication while the new verification mechanisms handle script authenticity independently.
Solution Approach 2:
An authorization gateway is introduced as an intermediary component between the identity provider and the broker. This gateway receives pre-authorization requests, generates verification metadata including SRI hashes and tokens, and provides them to the broker. The gateway acts as a mediator that enables script verification without requiring changes to the existing OAuth flow between other components.
2Adaptability or versatility
If authentication script is distributed through broker, then broker functionality is enabled, but script genuineness cannot be verified
Solution Approach 1:
The verification metadata including SRI hashes and tokens is generated in advance during the pre-authorization phase, before the authentication script is downloaded or executed. This preliminary action ensures that verification information is ready when needed, without requiring real-time analysis of the script during execution.
Solution Approach 2:
The system implements feedback mechanisms where the authorization gateway provides verification metadata to the broker, and the browser sends observed contextual information back to the gateway for validation. This feedback loop ensures that script authenticity is continuously verified throughout the authentication process.
3Ease of operation
If end-user agent executes authentication script, then authentication is performed, but trust cannot be established
Solution Approach 1:
The patent replaces manual trust establishment mechanisms with automated cryptographic verification. Instead of relying on users or administrators to manually verify script authenticity, the system uses Subresource Integrity (SRI) hashes and cryptographic tokens that are automatically verified by the browser and authorization gateway, establishing trust through mathematical proof rather than manual processes.
Data Source
AI summary
Mechanism to enable an Identity Provider having an authorization gateway and an authentication interface to control the download and the execution of an authentication script component managed by a broker or by a service provider.