Encrypted Credential Vault for Universal Web Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulties in managing multiple user IDs and passwords across various secure websites, leading to frustration and increased risk of fraud, as they often need to remember and enter different credentials for each site, and existing solutions require hardware tokens or complex authentication processes.
Innovation Solution
A user authentication system that uses a network server to authenticate clients with a personal identification number (PIN) and a GUID signed with a user certificate's private key, allowing for automatic log-on to multiple secure websites without requiring new hardware or changes to third-party websites, by using a local encrypted vault and public key infrastructure for secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users register the same user ID and password at most websites to simplify their life, then ease of operation is improved, but security is worsened due to user ID duplications and stricter password rules
Solution Approach 1:
The system segments authentication into two parts: a universal password for initial access and a website-specific encrypted credential vault. This allows users to have one simple password while maintaining secure access to multiple websites through the segmented credential storage mechanism.
Solution Approach 2:
The patent introduces an intermediary authentication system that acts as a mediator between the user and multiple websites. This intermediary manages the credential vault and handles authentication requests, allowing users to maintain simplicity while ensuring security through the intermediary's secure credential management.
2Reliability
If websites add more security factors like cookies during registration, then security is improved, but device complexity is worsened requiring additional hardware tokens or secure password stores
Solution Approach 1:
The patent creates a universal authentication system that works across multiple websites without requiring website-specific hardware tokens or secure password stores. The single credential vault system provides multi-functional security that operates universally across different web platforms.
Solution Approach 2:
Instead of requiring physical hardware tokens at each website, the system creates a digital copy of the credential vault that can be accessed across multiple websites. This virtual credential copy eliminates the need for physical hardware while maintaining security.
3Reliability
If users are required to remember and enter dozens or more user IDs and passwords, then security is improved, but ease of operation is worsened leading to frustration
Solution Approach 1:
The patent merges multiple website-specific credentials into a single encrypted credential vault that can be accessed with one universal password. This combining of multiple authentication mechanisms into one unified system maintains security while dramatically improving ease of operation.
4Reliability
If a secure password store or hardware token is required to access the vault of user IDs and passwords, then security is improved, but device complexity is worsened requiring USB-fobs or additional hardware
Solution Approach 1:
The patent replaces the mechanical hardware token system with a software-based encrypted credential vault that operates through standard computer memory and processing. This substitution eliminates the need for physical USB-fobs while maintaining security through cryptographic mechanisms.
Data Source
AI summary
An ID vault computer control program detects when a user's browser navigates to a third-party website that requires a user ID and password. If it hasn't done so already, it automatically requests a decryption key for a local encrypted vault file from a network server by supplying a personal identification number (PIN) from the user through the input device, a copy of the GUID, and a signature of GUID using a private key for the root certificate. If a decryption key is returned from the network server, the local encrypted vault file is unlocked and automatically supplies a corresponding user ID and password to log-on to the third-party website without the user.