Device-Based Authentication Using Cookie Stitching and 2FA
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional online security systems fail to adequately address unauthorized access to secure content by not distinguishing between users and devices, allowing access with verified authenticating information alone, even when accessed from different devices.
Innovation Solution
Implementing cookie-stitching and non-cookie-stitching methods to identify users and devices through unique identifiers and device metrics, requiring two-factor authentication (2FA) when device identification does not match, ensuring secure content access is granted only to authorized devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional systems verify only user authenticating information (username and password), then user access is granted quickly and easily, but security is compromised allowing unauthorized access from different devices
Solution Approach 1:
The authentication system is segmented into two distinct factors: something the user knows (username and password) and something the user possesses (computing device). This segmentation allows the system to verify both user identity and device association independently, preventing unauthorized access while maintaining a structured authentication process.
Solution Approach 2:
The computing device acts as an intermediary element in the authentication process. The system generates a device-specific identifier and compares it against stored identifiers to mediate between user credentials and access authorization. This intermediary verification layer adds security without requiring complex multi-step procedures for recognized devices.
2Reliability
If two-factor authentication is always required, then security is enhanced by verifying both user credentials and device association, but authentication time and user effort increase
Solution Approach 1:
The system applies partial authentication action by requiring full two-factor verification only when necessary. For devices with matching identifiers, the system performs only the minimal necessary verification (device identifier match), granting access without requiring the complete second factor authentication sequence. This selective approach reduces authentication time for trusted devices while maintaining security for unrecognized devices.
3Measurement precision
If the system tracks and stores device metrics for each user, then device identification accuracy is improved, but data storage requirements and processing complexity increase
Solution Approach 1:
The system extracts only the essential device identifier information needed for authentication purposes, rather than storing complete device profiles or all possible device metrics. By taking out only the critical identification elements (device type, operating system, browser information combined into a unique identifier), the system achieves accurate device recognition while minimizing data storage requirements.
Data Source
AI summary
Techniques are disclosed to provide enhanced online security. When user authenticating information is provided to access secure content, a network server identifies the user via a website identifier. Some of the disclosed techniques leverage third party “cookie stitchers” to associate user data, which may include a website identifier, to the user's computing devices. If the cookie stitcher cannot identify a current computing device, or if a current website identifier does not match one stored in the user data, then 2-factor authentication (2FA) may be triggered. Other disclosed techniques leverage stored device management data (DMD), which uniquely identifies each computing device that is associated with a website identifier. These techniques allow the network server to block access to explicitly-identified computing devices, and to trigger 2FA unless specific computing device metrics, which are associated with a computing device, are matched to computing device metrics contained in the DMD.