Browserless Device Authorization Using Personal Identification Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional device authorization flows, such as OAuth 2.0 Device Authorization Grant and Authorization Code Flow with PKCE, are insufficiently secure for browserless or input-constrained devices like Smart TVs, and may involve too much overhead or be cumbersome for certain applications.
Innovation Solution
A device code flow method where a personal identification code is generated by a server in response to user input on a first device, sent to a second device, and used to generate a challenge, enhancing security by eliminating the need for storing the code on the client device and allowing universal compatibility across different devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional device code flow is used for browserless devices, then device authorization can be achieved, but security is insufficient
Solution Approach 1:
The patent introduces a personal identification code as an intermediary element that bridges the client device and server. This code is generated by the server, displayed to the user, and then used to prove possession of credentials without exposing the actual credentials. The intermediary code enables secure authorization in browserless environments by providing a verifiable proof mechanism that doesn't require traditional credential handling.
Solution Approach 2:
The patent extracts the credential verification process from the traditional OAuth flow by separating the proof of credential possession (personal identification code) from the credentials themselves. This extraction allows the authorization to proceed without the client device needing to store or handle sensitive credentials, thereby improving security while maintaining the authorization functionality.
2Reliability
If PKCE is used to enhance security, then security is improved, but overhead and complexity increase
Solution Approach 1:
The patent employs a disposable personal identification code that is generated for a single authorization transaction and then discarded. This code serves the same security purpose as PKCE's code verifier and challenge but with simpler implementation - it's a single-use token that proves credential possession without requiring the complex cryptographic operations and state management that PKCE demands. The code is cheap to generate and dispose, providing security without the overhead.
3Productivity
If conventional device flow is used, then authorization can be obtained, but user experience is poor due to repetitive credential input
Solution Approach 1:
The patent implements preliminary action by having the server generate and provide the personal identification code to the user before the actual authorization request is made. This pre-provisioning of the proof code eliminates the need for users to repeatedly input credentials, as the code can be automatically provided or easily entered once. The preliminary generation and distribution of the authorization proof streamlines the process and improves user convenience while maintaining security.
Data Source
AI summary
Systems and methods relate generally to device code flows. In an example, a method relating generally to a device code flow is disclosed. In such a method, a personal identification code is generated by a server responsive to input of a user code and associated credentials from a first user device. The personal identification code is sent to a second user device different from the first user device. Input of the personal identification code via the first user device is requested. A challenge is generated using the personal identification code.