Autogenerated Aliases for Web Application Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users are vulnerable to spoofing and phishing attacks when authorizing access to third-party data, as existing methods lack secure mechanisms to verify the authenticity of web applications.
Innovation Solution
An authorization service generates a unique human-readable alias for web applications, which is presented to users for verification before allowing access to protected resources, preventing malicious actors from gaining unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authorization methods are used to allow web applications to access third-party data, then ease of operation is improved, but security is worsened due to vulnerability to spoofing and phishing attacks
Solution Approach 1:
The patent introduces an authorization service as an intermediary between the user and the web application. This service generates and manages aliases that mediate the authorization process, allowing users to verify application identity without directly exposing sensitive credentials or relying solely on application-provided identifiers. The intermediary service thus enables secure authorization while maintaining ease of operation.
Solution Approach 2:
The patent replaces traditional mechanical verification methods (such as checking application names or URLs) with a cryptographic verification system. The authorization service generates cryptographic aliases that can be verified through mathematical proofs, substituting manual verification processes with automated cryptographic validation that is both secure and user-friendly.
2Ease of operation
If application names are used for identification, then ease of operation is improved, but security is worsened due to name spoofing attacks
Solution Approach 1:
The patent transforms the identification parameter from human-readable application names to cryptographic aliases generated by the authorization service. These aliases are derived from cryptographic materials (such as public keys or certificates) and can be verified through cryptographic means. This parameter change maintains ease of identification while making spoofing attacks infeasible, as attackers cannot generate valid cryptographic aliases without the corresponding private keys.
Solution Approach 2:
The authorization service performs preliminary action by generating and registering cryptographic aliases for applications before they request user data access. This advance preparation creates a verified identity framework that prevents spoofing, as the alias is already bound to the application's cryptographic credentials before the authorization request occurs.
3Reliability
If cryptographic verification is implemented to prevent spoofing, then security is improved, but device complexity is worsened
Solution Approach 1:
The authorization service performs self-service by automatically generating, managing, and verifying cryptographic aliases without requiring manual configuration or complex user setup. The system autonomously handles cryptographic key pairs, alias generation, and verification processes, reducing the perceived complexity for users while maintaining high security standards.
Solution Approach 2:
The authorization service is designed as a universal system that handles multiple functions: generating aliases, verifying identities, managing authorization requests, and preventing spoofing attacks. By consolidating these cryptographic functions into a single multi-functional service, the patent reduces overall system complexity compared to implementing separate cryptographic verification mechanisms throughout the system.
Data Source
AI summary
Database systems and methods are provided for authorizing access to a protected resource. One method involves an authorization service automatically assigning a unique alias to a web application and thereafter receiving a request for access to a protected resource on behalf of a user of the web application. In response to the request, the authorization service generates a graphical user interface (GUI) display including a graphical representation of the unique alias automatically assigned to the web application at a client device associated with the user, and thereafter in response to user selection of a GUI element of the GUI display to authorize access, the authorization service obtains an access token associated with the user and the protected resource and transmits the access token to the web application.