Dynamic Single-Use URL Authentication System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication mechanisms, such as OpenID and Cardspace, are insecure due to lack of standardization, reliance on HTTP redirects, and platform dependency, making them vulnerable to security risks and limiting portability and flexibility.
Innovation Solution
A network-based authentication system where users register with an authentication provider, which generates dynamic, single-use URLs for service providers, allowing authentication through a standard browser without HTTP redirects, ensuring secure and portable access across multiple platforms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OpenID authentication is used, then user authentication across multiple service providers is enabled, but security vulnerabilities arise due to HTTP redirects and lack of trust enforcement
Solution Approach 1:
The patent extracts the authentication verification process from the service provider's domain and relocates it to the user's domain. The service provider only receives an authentication result (pass/fail) without handling credentials or performing verification, thereby removing the security vulnerabilities associated with credential transmission and HTTP redirects while maintaining cross-service authentication capability
Solution Approach 2:
The patent introduces the user's domain as an intermediary between the service provider and the authentication process. The user's domain acts as a trusted mediator that performs authentication verification locally and returns only the result to the service provider, eliminating the need for direct credential exchange and HTTP redirects between the service provider and authentication server
2Reliability
If Cardspace authentication is used, then secure local authentication is achieved, but platform dependency on Microsoft Windows limits portability
Solution Approach 1:
The patent creates a universal authentication mechanism that functions across multiple platforms and domains. By performing authentication verification in the user's domain rather than relying on platform-specific clients, the system achieves both security and platform independence, allowing the same authentication approach to work on any operating system or device
3Ease of operation
If centralized authentication is used, then user credentials are managed centrally, but users must remember numerous credentials for different service providers
Solution Approach 1:
The patent segments the authentication process into two distinct parts: credential verification (performed in the user's domain) and service access (granted by the service provider). This segmentation allows the user to manage credentials centrally in their own domain while service providers only need to handle simple authentication results, eliminating the need for users to remember multiple credentials
4Adaptability or versatility
If HTTP redirects are used in authentication, then authentication flow between domains is enabled, but security weak points are introduced
Solution Approach 1:
The patent extracts the credential verification step from the service provider's domain and performs it locally in the user's domain. This extraction eliminates the need for HTTP redirects that transmit credentials across domains, removing the security vulnerability while preserving the ability to authenticate across multiple service providers
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A method of authenticating a user to a service provider by means of an authentication provision unit, the method comprising: in a first stage of the method: receiving credentials from a user; determining whether the credentials received from the user represent a valid logon; and if that determination is positive: generating at least one network address comprising a domain address and at least one instance parameter, the instance parameter uniquely identifying the user and the instance of generation of the network address; and providing the network address to the user; and in a second stage of the method: receiving a parameter from a service provider; determining whether the received parameter indicates a valid attempt to log on to the service provider by checking that the received parameter matches an instance parameter that has previously been issued to a user and that has not previously been received from a service provider; and if that determination is positive: signalling to the service provider over a secure channel a message indicating that the received parameter represents a valid logon attempt, the message including credentials of the user to whom the instance parameter that matches the received parameter had been issued.