Companion Device Securing Mobile Inputs via Audio Stream
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices are vulnerable to security attacks during online transactions due to untrusted environments, such as man-in-the-browser attacks and malware, which can intercept authentication means like passwords or PIN codes, especially when users install malicious apps or delay security updates.
Innovation Solution
A method using a companion device that acts as an input and audio device to create a validation token by mixing user inputs, a random number, and a hash of the transaction text, ensuring that only the user can validate transactions, even if an attacker controls the mobile device, by using an audio stream to communicate parameters and validate user inputs securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users install applications from app stores or use complex web-based applications, then functionality and service access are improved, but security vulnerabilities increase due to potential malware and man-in-the-browser attacks
Solution Approach 1:
The patent introduces a companion device as an intermediary between the user and the mobile device. This companion device intercepts and validates authentication inputs (passwords, PINs) before they reach the potentially compromised mobile device. The companion device acts as a trusted mediator that prevents malware on the mobile device from capturing authentication credentials, thus resolving the contradiction between service accessibility and security vulnerability.
2Ease of operation
If the mobile device is used directly for authentication inputs, then ease of operation is improved, but reliability deteriorates due to potential interception by attackers controlling the device
Solution Approach 1:
The companion device serves as a trusted intermediary that the user interacts with directly for authentication inputs. The user enters credentials on the companion device rather than the mobile device, maintaining ease of operation while ensuring reliability since the companion device is not controlled by potential attackers. The companion device then securely transmits the authenticated credentials to the mobile device.
Solution Approach 2:
Instead of having the mobile device directly capture authentication inputs (the conventional approach), the patent inverts the flow by having the companion device capture inputs first and then relay them to the mobile device. This inversion ensures that the authentication credentials are captured in a trusted environment before being transmitted to the potentially untrusted mobile device.
3Duration of action of stationary object
If security updates are delayed or not installed on older devices, then device longevity and usability are maintained, but security protection against new threats is reduced
Solution Approach 1:
The patent implements a prior cushioning mechanism by introducing the companion device as a pre-deployed security layer that protects against threats before they can exploit vulnerabilities in outdated mobile device software. This external security layer compensates for the lack of security updates on older devices, allowing them to remain usable while protected against new security threats.
Data Source
Figure 1
Figure 2
AI summary
For securing user inputs in a mobile device (MD) using a service that is provided by an application server (AS) and requires user inputs from the mobile device, an apparatus comprises: means for enabling an input interface (IIC) and an audio interface (AIC) in order to be declared as a input device and an audio device for the mobile device (MD), means receiving parameters through the audio interface in an audio stream sent from the mobile device, the parameters being set by the application server and containing a query for user inputs for the service and a formula for a validation token, the query including a text for prompting for user inputs, means providing the query for user inputs, means receiving user inputs, means creating a validation token by applying the formula on the query, the user inputs and the random number, means sending the validation token in the form of required user inputs to the mobile device through the input interface, the token being sent to the application server by the mobile device.