Secure Credential Session via Disambiguation Data Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In electronic credential systems, there is a challenge in securely associating a credential app on a mobile device with a web service for transmitting identity credentials, as the app does not initially know whether the provided URL is trustworthy and from the intended service, especially in online transactions where phishing attempts can occur.
Innovation Solution
The system employs disambiguation data, such as a QR code or URL, to verify the origin of the web service before transmitting credentials, using cryptographic signatures and TLS protocols to ensure authenticity and trustworthiness, and provides user interfaces for consent and validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the credential app directly connects to a provided URL, then the connection process is simple and fast, but the security is compromised as the app cannot verify if the URL is from the intended service
Solution Approach 1:
The system performs preliminary actions by obtaining disambiguation data before establishing the connection. The credential app first retrieves disambiguation data (such as a second QR code or URL) that contains verification information, then uses this data to verify the web service's identity before proceeding with the credential transmission. This preliminary verification step ensures security while maintaining a relatively simple user flow.
Solution Approach 2:
The disambiguation data acts as an intermediary element between the credential app and the web service. Instead of directly connecting based solely on a URL, the system introduces disambiguation data (containing cryptographic signatures, service identifiers, or verification tokens) that mediates the connection process. This intermediary enables the app to verify the web service's authenticity without complicating the overall connection mechanism.
2Reliability
If the system implements verification of disambiguation data, then the authenticity of the web service is confirmed, but the time required for connection establishment increases
Solution Approach 1:
The verification of disambiguation data is performed as a preliminary action before the actual credential transmission. The system obtains and verifies disambiguation data (such as cryptographic signatures or service identifiers) in advance, ensuring that the verification process is completed before the time-sensitive credential exchange occurs. This approach minimizes the impact on overall connection time while maintaining strong authenticity verification.
Solution Approach 2:
The system efficiently processes the verification of disambiguation data by using cryptographic methods that can be quickly validated. The disambiguation data contains pre-computed verification information (such as digital signatures or tokens) that can be rapidly verified without requiring time-consuming back-and-forth communication, thus minimizing the time added to the connection establishment process.
Data Source
AI summary
Various systems and methods for securely sharing private information are described herein. A method of using disambiguation data to confirm the association with an online web service prior to engaging in a transaction, includes receiving, at an unresolved credential application executing on a mobile device, a disambiguation payload, wherein the disambiguation payload is purportedly associated with a web service, and wherein at least a portion of the disambiguation payload is signed with a cryptographic key associated with the web service; extracting a network location from the disambiguation payload; obtaining verification data from a resource at the network location to verify the web service; and validating the disambiguation payload using the verification data.