Client-Side Security Key Generation via SDK
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Attackers use bots to commit unauthorized acts and malicious users intercept communications, making it difficult for web server administrators to distinguish between legitimate user requests and bot-generated requests, posing security threats.
Innovation Solution
A security component is integrated into client-side applications using a software development kit (SDK) that generates security keys based on parameters provided by a security server, allowing validation of requests without transmitting the secret cryptographic key over the network, thereby enhancing security without requiring new hardware or software installations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security keys are generated on the client side using an SDK, then security is improved by not transmitting secret cryptographic keys over the network, but device complexity increases due to integration requirements
Solution Approach 1:
The patent introduces a security server as an intermediary that provides key components to client devices. The security server generates and distributes key components that clients use to create security keys locally, eliminating the need to transmit secret cryptographic keys over the network while maintaining centralized security management
Solution Approach 2:
The cryptographic key is segmented into multiple key components that are distributed separately. The security server holds some key components while client devices receive others, allowing security keys to be generated through combination without transmitting the complete secret cryptographic key, thus improving security while managing complexity through distributed key management
2Reliability
If security keys are validated on the server side, then security is improved by detecting bot-generated requests, but response time increases due to validation overhead
Solution Approach 1:
Security keys are generated and prepared on the client side before requests are submitted to the server. The client device creates the security key using key components from the security server, so when the request arrives at the server, the validation can proceed more efficiently without requiring complex real-time key generation
Solution Approach 2:
The patent replaces traditional mechanical authentication methods (such as transmitting passwords or cryptographic keys over the network) with a cryptographic signature system. The client device signs requests with locally-generated security keys, and the server validates these signatures, eliminating the need for time-consuming key transmission and enabling faster authentication
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are provided for client-side security key generation. An initial request is received from an application executing on a client device. The application includes a security component includes security code. In response to the initial request, a key component is generated. The key component includes one or more parameters from which a valid security key can be generated at the client device by executing the security code. The key component is provided to the client device. A security key associated with a request from the client device to an application server is received. The security key is checked for validity. In response to determining that the security key is valid, processing of the request by the application server is caused.