Authenticator App Encrypting Credentials for Consent Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the context of real-time payments and multiple service applications on a user device, there is a risk of unauthorized transactions due to sensitive user credentials being accessible by malicious or vulnerable service applications, compromising security across different services.
Innovation Solution
An authenticator application that encrypts user credentials using a remote entity's public key, preventing the service application from accessing unencrypted credentials, and ensures secure authentication by validating user credentials before performing operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If service applications store and access user credentials in unencrypted form for authentication, then authentication operations can be performed efficiently, but security is compromised as malicious or vulnerable applications can access sensitive credentials
Solution Approach 1:
The patent extracts the sensitive credential storage and encryption function from the service application and places it in a separate authenticator application. The authenticator application securely stores credentials in encrypted form and only provides encrypted authentication tokens to service applications, preventing direct access to plaintext credentials while maintaining authentication functionality.
Solution Approach 2:
The authenticator application serves as an intermediary between the service application and the credential storage system. It receives authentication requests from service applications, retrieves and encrypts credentials, and returns encrypted tokens without exposing the actual credential values to the service application or potential attackers.
2Adaptability or versatility
If multiple service applications access user credentials for authentication, then users can operate multiple services conveniently, but the risk of unauthorized transactions increases if credentials are compromised
Solution Approach 1:
The patent segments the authentication system into two independent components: an authenticator application that securely manages credentials and service applications that require authentication. Each service application receives only encrypted tokens from the authenticator, not the actual credentials, so that even if one service is compromised, the attacker cannot access credentials to impersonate the user across other services.
Solution Approach 2:
The authenticator application acts as a mediating security layer between multiple service applications and the user's credentials. It controls and monitors authentication requests from different services, encrypts credentials before any service can access them, and provides encrypted tokens that limit the scope of potential unauthorized access.
3Reliability
If service applications handle user credentials directly, then authentication can be performed, but security updates must be applied to each application individually increasing maintenance complexity
Solution Approach 1:
The patent merges the credential storage, encryption, and security management functions into a single authenticator application, separate from individual service applications. This centralization means that security updates, encryption algorithm changes, or vulnerability patches only need to be deployed to the authenticator application once, and all service applications automatically benefit from the improved security without requiring individual updates.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method (1000) for authenticating operations within consent architecture includes obtaining an operation request (142) requesting a service application (140) to access a remote entity (130) to perform an operation (138). The method also includes issuing, by the service application, an authentication request (152) requesting an authenticator application (150) to obtain user authentication credentials (154) for authenticating a user (12) before the remote entity performs the operation. The method also includes encrypting, by the authenticator application, the obtained user authentication credentials using a public key (132) of the remote entity. The service application is restricted from obtaining the user authentication credentials in unencrypted form. The method also includes providing, by the authenticator application, the encrypted user authentication credentials to the service application and transmitting, by the service application, the operation request and the encrypted user authentication credentials to the remote entity.