Inline Frame for Secure Third-Party Password Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The OAuth framework has security flaws that allow sensitive user information to be compromised during the authorization process, as it redirects users to potentially rogue URLs, exposing confidential information.
Innovation Solution
A method using an inline frame (iframe) on a client device creates a secure connection with an authorization server, proxies user authorization credentials securely, and receives an authorization code to obtain an access token without revealing credentials to the first application, employing encryption and secure protocols like TLS/HTTPS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OAuth redirects users to third-party servers using URLs containing sensitive information, then authorization access is enabled, but user confidential information may be compromised by rogue URLs
Solution Approach 1:
The patent introduces an inline frame as an intermediary component that sits between the first application and the authorization server. This inline frame creates a secure isolated environment where user credentials are entered and transmitted directly to the authorization server without exposing them to the first application or being vulnerable to rogue URL redirects. The inline frame acts as a mediator that enables authorization access while protecting user information from compromise.
2Ease of operation
If user credentials are shared with third-party applications for authorization, then access to services is granted, but security and confidentiality are reduced
Solution Approach 1:
The inline frame serves as a secure intermediary that enables service access without requiring the first application to handle user credentials. Users can authenticate through the inline frame to third-party services, and the authorization code is transmitted securely to the first application without exposing actual credentials. This maintains ease of operation for service access while significantly improving security and reliability.
Solution Approach 2:
The patent segments the authentication process into distinct isolated components: the inline frame handles credential input and transmission to the authorization server, while the first application only receives the final authorization code. This segmentation prevents the first application from accessing sensitive credentials, maintaining security while enabling service access.
3Device complexity
If traditional OAuth URL redirection is used for authorization, then the process is simple, but security vulnerabilities increase due to exposure of sensitive information in URLs
Solution Approach 1:
The inline frame intermediary maintains the simplicity of the OAuth authorization process flow while eliminating security vulnerabilities. It provides a secure interface for credential entry and transmission without complicating the overall authorization workflow. The first application still receives authorization codes as in traditional OAuth, but the vulnerable URL redirection step is replaced by the secure inline frame mechanism.
Data Source
AI summary
Disclosed herein are system, method, and apparatus for assisted third-party password authentication. The method performed at a client device includes creating a secure connection from an inline frame associated with a first application on the client device to an authorization server for accessing a second application. The method includes identifying, by the inline frame, one or more events that represent inputs for a user authorization credential, and proxying, by the inline frame, the identified one or more events to the authorization server using the secure connection. The method includes receiving an authorization code from the authorization server in response to the proxying. The method includes redirecting, by the inline frame, the authorization code to the application on the client device. The method includes transmitting, from the client device to the authorization server, the authorization code to receive an access token for accessing the second application.