Browser-Based User Authentication Without Push Notifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication mechanisms using smartphones or dedicated devices are insecure, cumbersome, and expensive, with single-use codes and push notifications posing security risks and deployment challenges.
Innovation Solution
A method involving a second user device enrolled with an authentication server, using a web browser for authentication via a URL and a locally stored proof of enrollment, eliminating the need for unmanaged infrastructure and dedicated applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If single-use codes are sent to smartphone via unmanaged third-party infrastructure, then authentication can be performed, but security is compromised
Solution Approach 1:
The patent extracts the authentication functionality from unmanaged third-party infrastructure and implements it directly within the organization's controlled environment. The authentication server and enrollment system are deployed on-premises or in a trusted cloud environment, eliminating dependence on external service providers and their associated security risks.
Solution Approach 2:
The patent introduces a dedicated authentication server as an intermediary between the user's smartphone and the application server. This server manages the enrollment process, stores enrollment tokens securely, and handles authentication requests, providing a controlled and secure communication channel that eliminates the need for unmanaged third-party infrastructure.
2Reliability
If dedicated devices like USB keys or card boxes are used to generate single-use codes locally, then authentication security is improved, but deployment cost and complexity increase
Solution Approach 1:
The patent makes the smartphone serve multiple functions: it acts as both the user's communication device and the authentication device. The enrollment application installed on the smartphone handles token generation, storage, and presentation, eliminating the need for separate dedicated authentication devices like USB keys or card boxes.
Solution Approach 2:
The patent creates a software-based authentication mechanism that replicates the functionality of hardware security devices. The enrollment application on the smartphone creates and manages digital tokens that serve the same security purpose as physical security devices, but with lower cost and easier deployment.
3Ease of operation
If push-type notifications are sent to smartphone application, then authentication can be performed, but user overload occurs leading to fraudulent validation
Solution Approach 1:
The patent performs preliminary enrollment of the smartphone with the authentication server before authentication is needed. During enrollment, the authentication server stores a unique enrollment token associated with the device. This pre-established relationship allows for targeted, device-specific authentication requests without overwhelming the user with generic notifications.
Solution Approach 2:
The patent implements a feedback mechanism where the authentication server sends requests specifically to the enrolled smartphone, and the smartphone provides authenticated responses only when the request is legitimate. The server can verify the authenticity of each request using the stored enrollment token, providing feedback control that prevents fraudulent validation while maintaining user convenience.
Data Source
AI summary
The invention relates to a method for authenticating a user in a first device, the method including sending, by an authentication client of the first device or the application, to an authentication server, an authentication request. The method also includes, in response to the authentication request, sending by the authentication server a first message comprising an authentication URL and a transaction identifier, opening the URL in a web browser running on a second user device, previously enrolled with the authentication server, and verifying the identity of the user by the second user device. The method also includes, when the verification is successful, providing by the second user device to the authentication server, a proof of enrollment stored in the second device during the enrollment of the second device, in order to authenticate the user. The invention also relates to a computer program and a system implementing such a method.