Biometric Login Authentication Across Browsers Without Cookies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods for online transactions, particularly through payment providers, are insecure and require repeated login credentials across different browsers, leading to inefficiencies and potential misuse of device-specific information.
Innovation Solution
Implementing biometric authentication using Intel® Software Guard Extensions (SGX) technology to securely store device-specific tokens and biometric data, allowing seamless transactions across browsers without the need for repeated login credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cookie-based authentication is used, then user identification across sessions is enabled, but security is compromised as cookies can be copied and used by unauthorized individuals
Solution Approach 1:
The patent replaces the traditional cookie-based mechanical authentication system with a biometric authentication system using fingerprint scans. The fingerprint sensor captures unique physiological data, which is then processed and compared against stored templates, substituting the vulnerable cookie mechanism with a biologically-based security system that cannot be easily copied or stolen.
Solution Approach 2:
The patent changes the authentication parameter from stored cookie data (which can be copied) to biometric fingerprint data (which is unique and difficult to replicate). The system transforms the authentication basis from a digital token to a physiological characteristic, fundamentally altering the security parameter while maintaining user convenience.
2Productivity
If device-specific cookies are stored, then instant checkout across merchants is enabled, but the system cannot distinguish between legitimate users and bad actors using stolen credentials
Solution Approach 1:
The patent replaces the cookie-based device identification mechanism with biometric authentication. Instead of relying on stored device tokens that can be stolen, the system uses fingerprint verification to uniquely identify legitimate users, enabling risk assessment systems to accurately distinguish between authorized users and unauthorized actors attempting to use stolen credentials.
Solution Approach 2:
The patent introduces biometric data as an intermediary verification layer between the user and the transaction system. The fingerprint sensor and processing system act as intermediaries that verify user identity before allowing transactions, providing an additional layer of trust that enables accurate risk assessment while maintaining transaction efficiency.
3Reliability
If repeated login credentials are required across different browsers, then security is maintained, but user experience and transaction completion time are degraded
Solution Approach 1:
The patent implements a universal biometric authentication system that works across different browsers and devices. The fingerprint-based authentication method serves multiple functions: it provides security verification, enables instant checkout, and works consistently across various platforms and browsers, eliminating the need for browser-specific cookies or repeated credential entry.
Solution Approach 2:
The patent substitutes the traditional repeated credential entry process with a single biometric registration and verification system. Users provide their fingerprint once during registration, and subsequent authentication across different browsers and devices is performed automatically through fingerprint scanning, eliminating the time-consuming repeated login process while maintaining security.
Data Source
AI summary
As disclosed herein, a token and/or a public/private key can be stored in a secure enclave that can be later used when a user logs into the payment provider's website. At that time, the user can simply swipe a fingerprint to complete a transaction. Thus, biometric authentication may be applied to complete the transaction. Moreover, the transaction can be completed across different browsers. In an implementation, a long-term token is not utilized. Instead, when a user opts into the disclosed implementation, a private and public key pair is generated on the client side device. The private key may be stored in the secure enclave and the public key may be sent to the payment provider. Thus, there may be no token involved to complete the transaction.