Stateless Authentication via Browser Security Module Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods in electronic environments often expose security credentials, making them susceptible to interception and impersonation, as they require transmitting sensitive information outside the protected environment.
Innovation Solution
Implementing a stateless and secure authorization approach using a browser security module (BSM) that signs requests with secret information without exposing the secret, allowing recipients to verify the signature without needing the shared secret, and using a proxy to limit access and prevent unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security credentials are sent along with communications to enable authentication, then authentication capability is improved, but security is worsened because the credentials become exposed to interception and impersonation
Solution Approach 1:
The patent introduces a proxy server as an intermediary between the client and the destination server. The proxy server receives requests from the client, signs them with a shared secret, and forwards them to the destination server. This mediator approach allows authentication without exposing the shared secret in network traffic, as the signature is computed locally and only the signed request is transmitted.
Solution Approach 2:
The patent extracts the shared secret from the network transmission by using it locally in the client to sign requests. Instead of sending the shared secret along with communications, the system uses the extracted secret locally to generate signatures that are appended to requests, eliminating the need to transmit the secret itself across the network.
2Reliability
If shared secrets are used to sign requests for authentication, then security against impersonation is improved, but device complexity is worsened due to the need for secret management and signature verification
Solution Approach 1:
The patent implements a universal authentication mechanism where the same shared secret can be used across multiple communication sessions and with multiple destination servers. The signature verification process is standardized and can be performed by any authorized party possessing the shared secret, eliminating the need for complex session-specific authentication mechanisms.
Solution Approach 2:
The patent performs preliminary actions by pre-establishing and storing shared secrets in the client's local memory before authentication is needed. The client proactively generates and stores signatures for authentication purposes, so that when requests need to be authenticated, the signatures are already prepared and can be appended without complex real-time computation or secret management during the actual communication.
Data Source
AI summary
Authenticated requests can be sent without requiring the requests to include or potentially expose secret information used for the authentication process. A client device use a security credential such as a key to sign a request to be sent to a recipient. When the request is received, the recipient determines whether the request was signed using the correct key for the sender. In some embodiments a client token is included with the request that statelessly encodes the key, enabling a recipient capable of decoding the client token to determine the key and compare that key to the signature of the request. The sender can store the secret information in a secure location, such as a browser security module, such that the secret information is not exposed to the browser or script executing on the client device.