Mobile Authentication via Security Server Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, such as passwords and one-time passwords, are vulnerable to attacks and cumbersome, especially on mobile devices, and current transaction authentication techniques are costly and inconvenient for frequent use.
Innovation Solution
A method utilizing a security server and a mobile application to provide secure login and transaction authentication on smart devices, where a PIN is generated and shared between the security server and the network site, eliminating the need for user input and storage, and using public shared storage for session management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, OTPs, smart cards) are used, then user login can be achieved, but security is weak and susceptible to MITM/MITB attacks
Solution Approach 1:
The patent introduces a security server as an intermediary between the user's mobile device and the network site. This server generates and manages one-time passwords and authentication tokens, mediating the authentication process to prevent direct exposure of user credentials to potentially malicious sites, thereby resolving the vulnerability to MITM/MITB attacks
Solution Approach 2:
The system performs preliminary authentication actions by pre-generating one-time passwords and establishing secure sessions before actual transactions occur. The security server prepares authentication credentials in advance, ensuring that when users access network sites, the authentication is already secured against attacks
2Reliability
If out of band authentication (voice calls, text messages) is used for transaction verification, then transaction security is improved, but convenience deteriorates and costs increase
Solution Approach 1:
The mobile application on the user's device automatically performs transaction authentication without requiring manual user actions. The app retrieves one-time passwords from the security server, verifies transactions, and completes authentication autonomously, making the secure process as convenient as regular browsing
Solution Approach 2:
The security server and mobile application provide a universal authentication mechanism that works across multiple network sites and transaction types. Instead of requiring different authentication methods for different scenarios, the system uses a unified approach through the mobile app that handles both login and transaction verification
3Reliability
If per-user shared secrets are used for one-time password systems, then authentication security is maintained, but system complexity and storage requirements increase
Solution Approach 1:
The patent extracts the shared secret from the user device and stores it exclusively on the security server. The mobile application does not store or handle the actual shared secret, eliminating the need for secure storage mechanisms on user devices while maintaining the security benefits of shared secrets
Solution Approach 2:
The security server acts as an intermediary that holds and manages the shared secrets centrally. Instead of distributing secrets across multiple user devices, the server mediates all authentication operations, simplifying the overall system architecture while maintaining security
Data Source
Figure 1
Figure 2
Figure 3
AI summary
To authenticate a user of a mobile communication device for login or transaction authorization, a first application on the device directs transmission of a request for authentication of the user to a security server. A second application on the device receives the request for authentication from the security server and directs presentation of the received request for authentication to the user by the device. The second application receives a user input to the device indicating that the requested authentication should proceed and in response directs transmission of an indication that the requested authorization should proceed, to the security server. In response to this latter transmission, the second application receives a PIN from the authentication server. The first application directs transmission of the PIN received by the second application to the network site, which validates the transmitted PIN, in order to authenticate the user or the transaction to the network site.