HTTP Cookie Digital Signature Authentication Bypassing Captcha
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face challenges in providing convenient and efficient access to application services for trusted devices while preventing unauthorized access, particularly from automated software, without relying on inconvenient challenge-response tests like Captcha.
Innovation Solution
The method involves setting an HTTP cookie on a communication device with a user or group identification signed digitally, which is verified by an application server to grant access to services, potentially bypassing proof-of-work tests for trusted devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If challenge-response tests like Captcha are used to prevent automated software access, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The system performs preliminary authentication by setting HTTP cookies with digital signatures during initial device verification. This preliminary action establishes trusted device status before service access, eliminating the need for repeated challenge-response tests and maintaining both security and ease of operation
Solution Approach 2:
The patent introduces HTTP cookies with digital signatures as an intermediary authentication mechanism. These cookies serve as mediators between the communication device and application server, carrying verification information that replaces the need for direct challenge-response interactions and improves operational convenience while maintaining security
2Reliability
If digital signature verification is implemented for all devices, then security is improved, but device complexity increases
Solution Approach 1:
The system applies different authentication treatments to different devices based on their trusted status. Trusted devices with valid cookies receive streamlined access, while untrusted devices undergo full verification. This local differentiation maintains security for critical operations while reducing complexity for authenticated users
Solution Approach 2:
The patent implements partial verification by checking only the digital signature in the HTTP cookie for trusted devices, rather than performing complete authentication routines. This partial action approach maintains security for the critical signature verification while reducing overall device complexity for routine operations
3Ease of operation
If HTTP cookies with digital signatures are used for authentication, then ease of operation is improved, but loss of information increases
Solution Approach 1:
The application server provides feedback by verifying the digital signature in the HTTP cookie and determining trusted device status. This feedback mechanism ensures that authentication information is properly validated and maintained, preventing information loss while enabling convenient operation for trusted devices
Data Source
Figure 1
Figure 2
Figure 3
AI summary
in one illustrative example, a method in a communication device adapted for communications using Hypertext Transport Protocol (HTTP) involves setting, at the communication device, an HTTP cookie which includes a user identification of a user of the communication device and a message portion which is signed with a digital signature of the user, The communication device sends, to an application server site via the communication network, a request message which includes the HTTP cookie. If verification of the digital signature at the application server site is successful, the communication device will receive access to an application service of the application server site. In one variation, the HTTP cookie is alternatively set with a group identification of a group with which the user is associated, and the message portion is signed with a digital signature of the group. The group may be a plurality of users associated with a service provider which provides the communication device access to a communication service in the communication network, In this case, the HTTP cookie may be set with a token retrieved from the service provider, where the token includes the digital signature of the service provider,