Cross-App Authentication Using Device Attributes and Zero-Knowledge Proofs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, particularly in mobile devices, are inefficient and insecure, often relying on SMS-based verification which can be intercepted or exploited, and session hijacking techniques like cookie hijacking allow unauthorized access to user accounts.
Innovation Solution
Implementing a verification application on mobile devices that uses device attributes to generate a non-deterministic verifier for secure, zero-knowledge authentication, minimizing the need for SMS exchanges and enhancing security by deriving client passwords from device-specific attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SMS-based verification is used for user authentication, then ease of operation is improved, but security is worsened due to interception and exploitation risks
Solution Approach 1:
The patent replaces SMS-based verification (mechanical/physical system) with a cryptographic verification system using device attributes and zero-knowledge proofs. The verification application generates cryptographic verifiers from device attributes, eliminating reliance on vulnerable SMS channels while maintaining ease of operation through automated device-based authentication.
Solution Approach 2:
The patent introduces device attributes as an intermediary between the user and the authentication system. Instead of directly using SMS or passwords, the system uses device attributes (hardware identifiers, security certificates) as a mediator to generate cryptographic verifiers, providing both ease of operation and enhanced security.
2Productivity
If session cookies are used for authentication, then productivity is improved, but security is worsened due to cookie hijacking enabling unauthorized access
Solution Approach 1:
The patent replaces traditional session cookies with a cryptographic verifier system based on device attributes. Instead of using mutable cookies that can be hijacked, the system uses cryptographic proofs derived from immutable device attributes, eliminating cookie hijacking vulnerabilities while maintaining session management functionality for productivity.
Solution Approach 2:
The patent makes authentication credentials dynamic by generating verifiers from device attributes that can change (e.g., security certificates, hardware state) rather than using static cookies. This dynamic approach allows the system to adapt to security conditions while maintaining seamless authentication for productivity.
3Reliability
If device attributes are used to generate cryptographic verifiers, then security is improved, but device complexity is worsened
Solution Approach 1:
The verification application automatically extracts device attributes and generates cryptographic verifiers without requiring user intervention or complex manual configuration. The system self-services by autonomously managing the complexity of cryptographic operations, device attribute extraction, and verifier generation, thereby improving security while minimizing the perceived complexity for users.
Data Source
AI summary
According to examples, a system for enabling user authentication may include a processor and a memory storing instructions. The processor, when executing the instructions, may cause the system to receive user login credentials and initiate a user authentication process by receiving a challenge configured using an attribute of a system including the processor. The processor executes further instructions to determine the attribute value and to derive a zero-knowledge proof in response to the challenge. The zero-knowledge proof is provided to the challenge issuer to access services of one or more applications.