Client App Authentication via Device and Application Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge is to securely authenticate client applications accessing protected resources across multiple devices to prevent unauthorized access and misuse of data, as replicated client applications can be modified to gain access to resources without proper authentication.
Innovation Solution
The solution involves using a unique client application identifier and device identifier in an Authentication and Key Agreement (AKA) process by an authorization server, which generates access tokens for authenticated client applications, ensuring only legitimate access to protected resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If client applications are replicated across multiple devices for accessibility, then ease of operation is improved, but security deteriorates because replicated applications can be modified to gain unauthorized access
Solution Approach 1:
The patent segments the authentication process into two distinct parts: device authentication (authenticating the device holding the private key) and application authentication (authenticating the specific application through code signing). This segmentation allows replicated applications to be securely authenticated without compromising security, as each replica must present valid cryptographic proofs of both device and application identity.
Solution Approach 2:
The patent introduces an authorization server as an intermediary that mediates between the client application and the protected resource. The authorization server verifies cryptographic signatures and issues access tokens, preventing direct access by potentially malicious replicated applications while maintaining ease of operation for legitimate users.
2Ease of manufacture
If traditional authentication methods are used for replicated applications, then ease of manufacture is improved, but security deteriorates because replicated applications cannot be properly authenticated
Solution Approach 1:
The patent replaces traditional mechanical authentication systems (username/password, tokens stored in databases) with a cryptographic-based system using public key infrastructure. Applications are authenticated through code signing with digital certificates, and devices are authenticated through cryptographic proof of private key possession, eliminating the need for centralized credential storage and improving both security and scalability.
3Reliability
If unique credentials are assigned to each replicated application instance, then security is improved, but device complexity increases due to management overhead
Solution Approach 1:
The patent makes the device's private key serve multiple authentication purposes simultaneously: it authenticates the device itself, enables code signing verification for multiple replicated applications, and proves possession of credentials to the authorization server. This universal credential approach eliminates the need for separate credential management for each application replica, reducing complexity while maintaining security.
Data Source
AI summary
An authorization server receives a request for an access token, for accessing a protected resource, from a client application executing on a device, wherein the request includes a client identifier that uniquely identifies the client application and a device identifier that uniquely identifies the device. The authorization server performs authentication of the client identifier and the device identifier. The authorization server returns a valid access token to the client application, based on the authentication of the client identifier and the device identifier, to enable the client application access to the protected resource.