Browser Security Module Stateless Request Signing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods in electronic environments expose security credentials during transmission, making them susceptible to interception and impersonation, and often require stateful connections that compromise user control over secret information.
Innovation Solution
Implementing a stateless and secure authorization process using a browser security module (BSM) that signs requests with secret information without exposing the secret, allowing recipients to verify the sender's possession of the secret without storing it, and using a proxy to limit access and prevent unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security credentials (cookies or session tokens) are sent with communications to enable authentication, then the recipient can verify the sender's identity, but the secret information is transmitted outside the protected environment making it susceptible to interception and impersonation
Solution Approach 1:
The patent extracts the secret information (session token) from the transmitted communication packet. Instead of sending the actual secret, the system sends only a signature generated from the secret. The secret itself remains stored only on the server, while the signature travels with the communication, allowing verification without exposing the secret.
Solution Approach 2:
The patent introduces a signature as an intermediary element that mediates between the secret information and the verification process. The signature serves as a proxy that carries authentication information without revealing the underlying secret, enabling the recipient to verify authenticity without direct access to the secret.
2Reliability
If cookies or session tokens are transmitted with requests to maintain session state, then authentication can be verified, but the approach requires stateful connections that compromise user control over secret information
Solution Approach 1:
The patent removes the requirement for the client to store or manage session tokens by extracting the secret information management entirely to the server side. The client only needs to send signatures generated from locally stored but never transmitted secrets, eliminating the need for stateful cookie management while maintaining authentication reliability.
3Adaptability or versatility
If security credentials are stored and transmitted to enable cross-domain access, then authentication across domains is possible, but unauthorized transmission and access control become more difficult to manage
Solution Approach 1:
The patent uses signatures as intermediaries that can be verified by any domain holding the corresponding public key, enabling cross-domain authentication without complex credential management. The signature mechanism naturally supports multiple domains while maintaining simple access control through public key verification.
Data Source
AI summary
Authenticated requests can be sent without requiring the requests to include or potentially expose secret information used for the authentication process. A client device use a security credential such as a key to sign a request to be sent to a recipient. When the request is received, the recipient determines whether the request was signed using the correct key for the sender. In some embodiments a client token is included with the request that statelessly encodes the key, enabling a recipient capable of decoding the client token to determine the key and compare that key to the signature of the request. The sender can store the secret information in a secure location, such as a browser security module, such that the secret information is not exposed to the browser or script executing on the client device.