Web Service Authentication Using Email-Shared Keys and HMAC Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication sessions over public networks are vulnerable to attacks such as ARP spoofing, DNS spoofing, SSL stripping, and Session ID hijacking, which compromise the security of stateless HTTP or HTTPS protocols using JWT tokens or Session IDs, and there is a need to protect shared keys from exposure and code injection attacks.
Innovation Solution
Implementing a dedicated network channel, such as email, to share keys between clients and authentication services, using message-signatures encrypted with shared keys for validation, and separating static web pages into secure portions to protect the shared key from code injection and exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shared keys are transmitted over public networks using standard protocols, then communication between clients and authentication services is enabled, but the security of the shared keys is compromised due to vulnerabilities to ARP spoofing, DNS spoofing, SSL stripping, and other attacks
Solution Approach 1:
The patent introduces a dedicated network channel as an intermediary medium for transmitting shared keys between clients and authentication services. This dedicated channel is separate from standard communication protocols and provides isolated, secure key exchange. The intermediary channel prevents direct exposure of keys to vulnerable public network paths, thereby blocking spoofing and interception attacks while maintaining communication functionality.
2Ease of operation
If static web pages are made accessible to clients for authentication purposes, then authentication functionality is provided, but the shared keys stored in these pages become vulnerable to code injection and exposure attacks
Solution Approach 1:
The patent divides the static web page into two distinct segments: a secure portion that contains and protects the shared key, and a public portion that provides authentication functionality. The secure portion is isolated and restricted, allowing only the authentication service to access it, while the public portion is accessible to clients but cannot access the shared key. This segmentation prevents code injection attacks from reaching the sensitive key material while maintaining authentication service accessibility.
3Reliability
If message-signatures are implemented for validating data objects, then data integrity and authentication are improved, but the complexity of the communication protocol increases
Solution Approach 1:
The patent implements message-signatures that enable client computing devices to autonomously validate the authenticity and integrity of signed data objects received from authentication services. The validation process uses the shared key locally stored in the client's secure portion without requiring additional server verification steps. This self-service approach enhances data validation reliability while minimizing protocol complexity by eliminating round-trip verification requests.
Data Source
AI summary
The subject matter discloses system and method for securing the authentication of connections to web services over public networks with HMAC messages that utilizing shared key that is shared via mail.