Browser Authentication Using Decentralized Identity Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-based and centralized authentication schemes are vulnerable to attacks, lead to password fatigue, and lack universality and decentralization, posing risks of unauthorized access and account loss.
Innovation Solution
A browser-based decentralized authentication scheme using zero-knowledge proofs and asymmetric cryptography, allowing users to authenticate through their web browser without central mediation, enabling device-based authentication, secure end-to-end encryption, and decentralized identity management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If password-based authentication is used, then implementation simplicity is improved, but security is worsened
Solution Approach 1:
The patent replaces the mechanical/password-based authentication system with a cryptographic system using public-key infrastructure. Instead of relying on users to remember and securely transmit passwords, the system uses asymmetric cryptography where the user's private key proves identity without being transmitted, fundamentally substituting the authentication mechanism to achieve both simplicity and security.
Solution Approach 2:
The patent introduces a cryptographic intermediary layer (the public-key infrastructure and digital signature mechanism) between the user and the service provider. This intermediary enables secure authentication without requiring direct password transmission, resolving the contradiction by adding a mediating cryptographic layer that simplifies the user experience while enhancing security.
2Ease of operation
If centralized authentication schemes are used, then ease of operation is improved, but security and control are worsened
Solution Approach 1:
The patent inverts the traditional centralized authentication model by making the user the authority over their own identity through cryptographic keys, rather than relying on a centralized provider. The user's private key becomes the ultimate credential, and services must trust the user's cryptographic proof rather than the user trusting a centralized provider, fundamentally inverting the trust relationship.
Solution Approach 2:
The patent enables users to self-manage their authentication credentials through their private keys without requiring centralized management. Users can independently prove their identity to multiple services using their own cryptographic keys, eliminating the need for centralized account management and giving users direct control over their authentication, thus achieving ease of operation with enhanced security.
3Ease of operation
If social login is used, then ease of operation is improved, but universality and privacy are worsened
Solution Approach 1:
The patent creates a universal authentication mechanism based on cryptographic keys that can be used across any service supporting the protocol, without being tied to specific social login providers. The user's private key serves as a universal credential that works with any service implementing the authentication protocol, achieving true universality while maintaining ease of operation through single-sign-on capabilities.
Solution Approach 2:
The patent introduces a cryptographic intermediary layer that enables universal authentication across different services without requiring users to connect to specific social login providers. The digital signature mechanism acts as a universal mediator that any service can verify, eliminating the need for service-specific integration while maintaining ease of operation.
4Ease of operation
If social login is used, then ease of operation is improved, but device complexity is worsened
Solution Approach 1:
The patent extracts the authentication credential (private key) from centralized providers and places it directly in the user's device via secure browser storage. This extraction eliminates the need for complex client-side implementations of multiple social login protocols, reducing device complexity while maintaining ease of operation through automatic credential management.
Data Source
AI summary
Disclosed herein is a method performed by a client application of an authentication provider application. The method includes deriving a reference to a domain name based on an identity handle of a user, querying a domain name system to obtain one or more identity records associated with the identity handle, obtaining one or more public keys based on the one or more identity records, and deriving an authentication endpoint web address based on the identity handle. The authentication endpoint web address is usable to access the authentication provider application. The method further includes sending data to the authentication provider application using the authentication endpoint web address, wherein the authentication provider application is able to access one or more private keys corresponding to the one or more public keys for generating digital signatures. The method further includes receiving, from the authentication provider application, one or more digital signatures.