Cross-App Authentication Using Device Attributes and Zero-Knowledge Proofs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, particularly in mobile devices, are inefficient and insecure, often relying on SMS-based verification which can be intercepted or require manual entry of codes, and are vulnerable to session hijacking through stolen cookies, posing a risk to account security.
Innovation Solution
Implement a verification application on mobile devices that collects device attributes to generate a non-deterministic verifier, enabling zero-knowledge proof of identity without revealing attribute values, and uses Password Authenticated Key Agreement (PAKE) for secure, attribute-based authentication, minimizing SMS exchanges and detecting cookie hijacking through dynamic elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If SMS-based verification is used for user authentication, then authentication can be performed across multiple applications, but the system becomes vulnerable to interception and requires manual code entry
Solution Approach 1:
The patent replaces SMS-based verification with a cryptographic authentication mechanism using device attributes and zero-knowledge proofs. Instead of relying on SMS messages that can be intercepted, the system uses mathematical proofs (zk-SNARKs) to verify identity without exposing sensitive information, thereby eliminating the security vulnerability while maintaining cross-application functionality
Solution Approach 2:
The patent introduces a verification application as an intermediary layer between the user and multiple applications. This verification app generates device identifiers based on device attributes and handles authentication centrally, allowing multiple applications to authenticate users without each needing separate SMS verification, thus improving both security and versatility
2Ease of operation
If cookies are used for session authentication, then access to authenticated systems is enabled, but the system becomes vulnerable to cookie hijacking
Solution Approach 1:
The patent makes session identifiers dynamic by incorporating device attributes that change over time (such as location, device state) into the session token generation. Instead of static cookies that can be stolen and reused, the session authentication data dynamically adapts to device state changes, making hijacked cookies invalid and preventing unauthorized access while maintaining ease of legitimate access
3Reliability
If manual code entry is required for authentication, then SMS verification can be implemented, but the process becomes time-consuming and user-friendly alternatives are lost
Solution Approach 1:
The patent implements automatic authentication where the verification application on the user's device automatically generates device identifiers and performs authentication without requiring manual code entry. The system self-services the authentication process by using built-in device attributes (IMEI, Android ID, iOS ID) to automatically prove identity, eliminating both the time loss and the need for manual intervention while maintaining security
Data Source
AI summary
According to examples, a system for enabling user authentication may include a processor and a memory storing instructions. The processor, when executing the instructions, may cause the system to receive user login credentials and initiate a user authentication process by receiving a challenge configured using an attribute of a system including the processor. The processor executes further instructions to determine the attribute value and to derive a zero-knowledge proof in response to the challenge. The zero-knowledge proof is provided to the challenge issuer to access services of one or more applications.