Mobile Authenticator Application for Trusted Web Interface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile computing devices face unique security challenges due to limitations in screen size, user interface paradigms, and restricted operating systems, making them susceptible to attacks like phishing, clickjacking, and CSRF, where traditional mitigation techniques are ineffective.
Innovation Solution
Implementing a mobile authenticator application that serves as a trust anchor, providing a trusted user interface and using a challenge/response protocol to ensure user confirmation of authorized actions, thereby establishing a trusted path between the user and the server-side web application, and using a shared secret for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional web browser interfaces are used on mobile devices, then ease of operation is maintained, but security against attacks like phishing and clickjacking deteriorates
Solution Approach 1:
The patent introduces a mobile authenticator application as an intermediary between the web browser and the server. This mediator captures user input, verifies it against the user's intent through a trusted UI, and only submits authenticated requests to the server. This resolves the contradiction by adding a security layer without changing the user's interaction model with the web application.
Solution Approach 2:
The system segments the authentication process into separate components: the web browser handles the user interface, the mobile authenticator handles security verification, and the server handles business logic. This segmentation allows each component to specialize in its function, maintaining ease of operation in the browser while concentrating security functionality in the authenticator.
2Object-affected harmful factors
If security indicators and mitigation tools are added to mobile browsers, then security against attacks improves, but device complexity and UI space requirements worsen
Solution Approach 1:
Instead of complicating the browser with security indicators, the patent uses a separate mobile authenticator application as a mediator. This keeps the browser simple while providing robust security through the authenticator's challenge-response protocol and trusted UI verification.
Solution Approach 2:
The patent extracts security functionality from the web browser and places it in a separate mobile authenticator application. This extraction removes the burden of security implementation from the browser, maintaining its simplicity while providing comprehensive security through the dedicated authenticator.
3Ease of operation
If virtual keyboards are used for password input on mobile devices, then ease of operation is improved, but security of password selection deteriorates
Solution Approach 1:
The mobile authenticator acts as an intermediary that captures the user's input through a trusted UI and verifies it against the intended action. This prevents attackers from exploiting virtual keyboard limitations to induce insecure password choices, as the authenticator verifies the user's true intent rather than relying on the input method.
4Ease of operation
If mobile operating system restrictions are maintained, then ease of operation is preserved, but effectiveness of attack mitigation tools deteriorates
Solution Approach 1:
The mobile authenticator application serves as an intermediary that operates within the constraints of mobile OS restrictions while providing robust attack mitigation. It leverages the mobile device's native capabilities (camera, microphone, sensors) to create a trusted verification channel that bypasses browser limitations without requiring OS changes.
Data Source
AI summary
Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for user confirmation of actions to be performed by a web application hosted on one or more servers. Actions can include receiving user input indicating a request directed to the web application, the user input being received through a mobile web browser, determining that the user input is requesting execution of an authorized action, and in response, providing data associated with the request for processing by a mobile authenticator application, providing a user interface generated by the mobile authenticator application based on the data, and receiving user confirmation of the authorized action through the user interface, and in response: providing a signed response by the mobile authenticator application, and transmitting the signed response to the one or more servers to initiate execution of the authorized action.