Multi-Channel Credential Token Linking Without Secret Exposure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in securely registering and interacting with multiple channels, as credentials are exposed during registration and transactions, and are vulnerable to man-in-the-middle attacks.
Innovation Solution
A method and system that uses a server to receive a user device identifier and a secret, storing tokens associated with credentials across channels, allowing interactions without exposing the credentials directly, and using validated tokens for secure access across multiple channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users register credentials with each channel separately, then each channel can access the credential, but the registration process requires significant user actions and credentials are exposed
Solution Approach 1:
The patent introduces a processing system as an intermediary that manages credentials centrally. Instead of users directly registering with each channel, the processing system receives credentials once and distributes tokenized versions to multiple channels, eliminating repetitive registration actions while maintaining channel-specific access
Solution Approach 2:
The patent creates tokenized copies of credentials that can be distributed to multiple channels. These tokens are derived from the original credential through cryptographic hashing, allowing channels to verify credentials without exposing the original, thus enabling seamless multi-channel access with a single registration
2Adaptability or versatility
If credentials are transmitted via user devices to channels, then channels can access credentials, but credentials are exposed to hackers and intermediaries
Solution Approach 1:
The processing system acts as a secure intermediary that never exposes original credentials to channels. It receives credentials once from the user device, then generates and distributes cryptographic tokens to channels. This intermediary architecture ensures credentials remain protected while still enabling channel access through token verification
Solution Approach 2:
The patent extracts the sensitive credential data from the transmission path between user devices and channels. By separating the original credential (kept secure in the processing system) from the transmitted token (distributed to channels), the system removes the vulnerability of credential exposure while maintaining authentication functionality
3Ease of operation
If the same credential is used across multiple channels, then credential management is simplified, but the credential becomes more vulnerable to attacks
Solution Approach 1:
The patent segments the single credential into multiple channel-specific tokens. Each token is a cryptographic derivative of the original credential but cannot be reverse-engineered to reveal it. This segmentation allows simplified user management (one credential to rule them all) while maintaining security isolation across channels
Solution Approach 2:
The patent transforms the credential parameter from a single exposed value to multiple cryptographic hashes. By changing the parameter representation through cryptographic functions, the system maintains the convenience of single-credential management while achieving security through parameter transformation - each channel receives a different cryptographic representation that cannot be reverse-engineered
Data Source
AI summary
A method is disclosed. The method includes receiving from a user device operated by a user via a first channel, a user device identifier and a secret associated with the user. The method also includes storing a first token, the user device identifier, and a first channel identifier. The first token is associated a credential. The method also includes receiving, from the user device via a second channel, the user device identifier and the secret. The secret is subsequently validated. After the secret is validated, the server obtains a second token based on the first token and stores the second token, the user device identifier, and a second channel identifier. The second token is associated with the credential.