Link-Based Passive Authentication for P2P Transfers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User authentication methods, such as those based on credentials like usernames and passwords, are prone to errors, resource-intensive, and vulnerable to malicious activities, particularly in peer-to-peer fund transfers.
Innovation Solution
A system employing passive authentication that uses a link-based approach, where a user device is authenticated by matching a registered identifier with a network identifier, eliminating the need for user-provided credentials and reducing errors and resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credential-based authentication (username/password, PIN, biometric data) is used, then user authentication can be performed, but the system is prone to errors, resource-intensive, and vulnerable to malicious activities
Solution Approach 1:
The patent extracts the authentication verification process from the user's device and relocates it to the server. The server generates the authentication challenge and verifies the response, eliminating the need for users to manage complex credentials on their devices. This is achieved by the server generating a challenge value, sending it to the user device, and verifying the response without requiring the user to input or store sensitive authentication data.
Solution Approach 2:
The patent introduces a challenge-response mechanism as an intermediary between the user and the authentication system. Instead of directly using credentials, the user device receives a challenge from the server, processes it through a secure element, and returns a response. This intermediary process enhances security by preventing direct exposure of credentials while maintaining authentication reliability.
2Reliability
If credential-based authentication is used, then user authentication can be performed, but computing and network resources are consumed
Solution Approach 1:
The computationally intensive authentication operations are extracted from the user device and performed on the server. The server generates challenges and verifies responses, reducing the computing burden on user devices. The user device only needs to receive the challenge, process it through a secure element, and transmit the response, significantly lowering energy consumption.
Solution Approach 2:
The patent replaces traditional mechanical credential verification (checking usernames, passwords, biometric data) with a cryptographic challenge-response mechanism. This substitution reduces computing resources by using efficient cryptographic operations instead of complex credential validation algorithms on the user device.
3Ease of operation
If credential-based authentication is used, then user authentication can be performed, but the system is vulnerable to malicious activities
Solution Approach 1:
The patent converts the potential harm of credential exposure into benefit by using the user device's existing secure elements (which may have been compromised in other ways) to perform authentication. Even if the device is compromised, the secure element protects the authentication process. The challenge-response mechanism ensures that even if network traffic is intercepted, the credentials cannot be extracted or reused.
Solution Approach 2:
The challenge-response mechanism acts as an intermediary that prevents malicious activities by never exposing credentials. The server generates challenges that cannot be predicted or replayed, and the secure element on the user device ensures that responses cannot be extracted. This intermediary process blocks various attack vectors including phishing, credential stuffing, and man-in-the-middle attacks.
4Productivity
If passive authentication with link-based approach is used, then authentication speed is improved and resources are conserved, but the system requires a different authentication mechanism
Solution Approach 1:
The patent extracts the authentication logic from user-provided credentials and places it in the server-generated challenge. This allows for faster authentication since the user simply needs to interact with the link or token rather than manually entering credentials. The server handles the complex verification process, improving speed while managing the mechanism complexity centrally.
Data Source
AI summary
In some implementations, a device may obtain information indicating one or more exchanges, of a plurality of exchanges, of a first account associated with a first user that are to be resolved using a peer-to-peer transfer from a second account associated with a second user. The device may transmit a message, designated for a user device associated with the second user, that identifies a link associated with a resource. The device may receive, from a requesting user device, a request to access the resource. The device may determine an authentication of the requesting user device to access the resource. The device may provide, based on the authentication, the resource associated with the link for the requesting user device. The device may receive, from the requesting user device and via the resource, an indication to perform the peer-to-peer transfer, and may cause, based on the indication, the peer-to-peer transfer.