Interprogram Authentication Engine for Credential Theft Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices and applications are vulnerable to hacking and cyber-attacks, where attackers use valid log-in credentials to gain unauthorized access, modify user information, and exfiltrate data, degrading network performance and posing a challenge in detection and prevention.
Innovation Solution
The system employs interprogram communications between applications on a user device and a remote database to verify user identity by comparing user information from the database with user profile information from other applications, using an authentication engine to detect and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional log-in credential verification is used, then users can access applications, but the system becomes vulnerable to unauthorized access by bad actors with stolen credentials
Solution Approach 1:
The patent introduces an authentication engine as an intermediary component that sits between the log-in process and application access. This engine intercepts authentication requests, performs additional verification by comparing user information from multiple applications, and only permits access when verification succeeds. This intermediary layer prevents bad actors with stolen credentials from gaining unauthorized access while maintaining normal user authentication flows.
Solution Approach 2:
The system implements feedback by continuously monitoring and comparing user information across multiple applications. When a user attempts to log in, the authentication engine retrieves user information from other applications and compares it with the provided credentials. This feedback loop of verification and comparison enables real-time detection of credential theft attempts and dynamic adjustment of access decisions.
2Ease of operation
If user information is stored in remote databases, then applications can access user data, but the system becomes vulnerable to data exfiltration by attackers
Solution Approach 1:
The patent applies preliminary action by performing authentication verification before allowing any data access or exfiltration. The authentication engine proactively compares user information from multiple applications and validates credentials before the user can access remote databases or application data. This preliminary verification prevents attackers from exfiltrating data even if they have stolen credentials, as the authentication check occurs before any data transfer can take place.
3Object-affected harmful factors
If network bandwidth is limited to prevent data exfiltration, then security improves, but system throughput and performance degrade
Solution Approach 1:
The patent extracts the authentication verification function from the main data transmission flow. Instead of limiting network bandwidth for all traffic, the system extracts and performs authentication checks separately through the authentication engine using local comparisons. This allows normal network throughput to continue uninterrupted while security verification happens through local data comparison rather than network-based restrictions.
Data Source
AI summary
A device that includes a network interface configured to communicate with a remote database and a memory operable to store a set of applications. The device further includes an authentication engine implemented by a processor. The authentication engine is configured to receive log-in credentials for a user on a first application, to send a user information request to the remote database, and to receive user information in response to sending the request. The authentication engine is further configured to send a user profile information request to a second application and to receive user profile information in response to sending the request. The authentication engine is further configured to identify corresponding information between the user information and the user profile information, to determine that at least a portion of the corresponding information between the user information and the user profile information matches, and to authenticate the user in response to determination.