Device-Bound Authenticator Caller Verification Against Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for managing user identity authentication requests through device-bound authenticators are deficient, particularly in loose coupling scenarios that are susceptible to attacks and lack effective phishing resistance and flexibility in authorization.
Innovation Solution
Implementing a framework for authenticator applications and authentication services to establish an authenticity and signature chain of the calling process by identifying a process ID, obtaining a signature and metadata, and verifying the source's authorization to request user identity authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional techniques are used for managing user identity authentication requests, then ease of operation is maintained, but security is compromised due to susceptibility to phishing attacks
Solution Approach 1:
The system performs preliminary verification of the authenticator application's identity and authorization status before allowing authentication requests. This includes verifying digital signatures, checking authorization tokens, and confirming the application's right to access user identities, thereby preventing phishing attacks before they can compromise security.
Solution Approach 2:
The patent introduces an intermediary verification layer between the authenticator application and the authentication service. This intermediary system validates the authenticator's identity and authorization credentials, acting as a mediator that ensures only authorized applications can access user identities without complicating the user's authentication experience.
2Adaptability or versatility
If loose coupling is used between authenticator applications and authentication services, then adaptability is improved, but security deteriorates due to lack of authorization control
Solution Approach 1:
The system changes the parameters of interaction by introducing token-based authorization and signature verification mechanisms. Instead of tight coupling through direct integration, the system uses configurable authorization parameters and tokens that maintain loose coupling while ensuring security through verifiable authorization credentials.
Solution Approach 2:
The patent segments the authentication system into distinct components: the authenticator application, the verification service, and the authentication service. Each component operates independently with defined interfaces, allowing adaptability through modular design while maintaining security through structured authorization checks at each interface.
3Reliability
If authorization control is strengthened to prevent phishing attacks, then security is improved, but device complexity increases
Solution Approach 1:
The authenticator application performs self-verification by presenting its own digital signature and authorization credentials to the verification service. This self-service approach allows the system to maintain strong authorization control without requiring complex external verification infrastructure, as each component verifies itself against established cryptographic standards.
Solution Approach 2:
The patent replaces mechanical coupling and manual authorization management with cryptographic mechanisms including digital signatures, hash functions, and token-based authorization. This substitution reduces device complexity by using well-established cryptographic primitives instead of complex custom verification logic.
Data Source
AI summary
Methods, systems, and devices for process verification are described. An authenticator application of a device may receive, from an authenticating application of the device, a first request to establish a network connection between the authenticator application and the authenticating application. The first request may identify a port associated with the network connection. The authenticator application may receive a second request from the authenticating application to authenticate an identity of a user. The authenticator application may identify a process used to establish the network connection between the authenticator application and the authenticating application on the port. The authenticator application may obtain a signature and a set of data associated with the signature based on the identified process. The authenticator application may authenticate the identity of the user based on the signature and the associated set of data.