Credential App Verification Using Proof of Origin Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge in mobile ID systems is ensuring secure and reliable connection between a credential application on a mobile device and an online service, as the credential application does not know where to provide credentials due to the lack of trust in the URL provided by a potentially malicious web service, which can lead to phishing attempts or hacking.
Innovation Solution
A method where the credential application verifies the identity of the web service by receiving a disambiguation payload, confirming the web service's identity through user input or comparison with a separate channel, and establishing a connection only after verifying the web service's authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the credential application connects to the web service using the provided URL, then the connection speed and ease of operation are improved, but the security and reliability deteriorate due to potential phishing or malicious web services
Solution Approach 1:
The system performs preliminary verification of the web service's identity before establishing the connection. The credential application receives engagement data containing proof of origin information, verifies the web service's identity against this information, and only then proceeds to connect. This preliminary action ensures security is established before the connection is made, resolving the contradiction between ease of operation and security.
2Reliability
If the credential application verifies the web service's identity through additional checks, then the security is improved, but the complexity of the process increases
Solution Approach 1:
The system uses an intermediary mechanism where engagement data containing proof of origin information acts as a mediator between the credential application and the web service. Instead of implementing complex verification logic directly in the credential application, the verification process is facilitated through this intermediary data structure, which contains pre-packaged identity information that simplifies the verification process while maintaining high security standards.
3Reliability
If the credential application uses a separate channel to verify the web service's identity, then the security against phishing is improved, but the time required for connection increases
Solution Approach 1:
The proof of origin information is prepared in advance as part of the engagement data before the credential application needs to verify the web service's identity. This preliminary preparation of verification information allows the credential application to perform rapid verification without requiring time-consuming separate authentication processes, thus reducing connection time while maintaining security.
Solution Approach 2:
The system uses a copy of the web service's identity information (proof of origin) that is embedded in the engagement data. Instead of requiring the credential application to independently verify the web service's identity through complex authentication protocols, it compares the provided identity against the copied identity information in the engagement data, significantly reducing verification time while maintaining security.
Data Source
AI summary
Various systems and methods for securely transacting over the Internet are described herein. The systems and methods receive, at a credential application executing on a mobile device, a disambiguation payload based on an interaction with a web service. The systems and methods receive, by the credential application, information representing the web service. The systems and methods verify, by the credential application, that an identity of the web service matches the web service represented by the information. The systems and methods, in response to successfully verifying that the identity of the web service matches the web service represented by the information, connecting to the confirmed web service for providing one or more credentials from the credential application.