Mobile Device Certificate Store Authentication via QR Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, such as simple passwords and public key infrastructure (PKI), are inadequate for secure access to cloud-based applications due to complexity, inflexibility, and vulnerability to attacks, particularly in distributed environments where users need to access applications from various devices without proper device drivers or certificate management.
Innovation Solution
A method using a barcode scanner on a mobile device to authenticate users by encoding a nonce in a QR code, allowing the device to sign it with a private key from a certificate store and send it back over a network, enabling secure access to cloud-based applications without requiring specific device drivers or certificate installation on each device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI techniques are used to improve security, then authentication reliability is improved, but device complexity and ease of operation deteriorate due to difficulty in deployment and certificate management
Solution Approach 1:
The patent extracts the certificate store and private key from the authentication server environment and places it on the user's mobile device. This allows the private key to remain secure on the user's device while the server only needs to verify signatures, dramatically simplifying server-side deployment and certificate management while maintaining strong cryptographic security.
Solution Approach 2:
The patent creates a universal authentication mechanism that works across multiple devices and platforms. The mobile device with its certificate store can authenticate the user to any application server that implements the signature verification protocol, eliminating the need for device-specific drivers or complex certificate installation on each target device.
2Adaptability or versatility
If hardware tokens with USB interfaces are used to access certificates from multiple computers, then certificate accessibility is improved, but ease of operation deteriorates due to USB interface requirements and device driver installation
Solution Approach 1:
The patent replaces the mechanical USB connection system with a wireless network-based authentication system. Instead of requiring physical USB connections and device drivers, the mobile device communicates with application servers over standard network protocols, eliminating the need for USB interfaces and device driver installation on target devices.
3Ease of operation
If simple passwords are used to improve ease of operation, then ease of operation is improved, but reliability deteriorates due to vulnerability to dictionary attacks and password disclosure
Solution Approach 1:
The patent introduces a cryptographic intermediary layer between the user and the application server. The user's private key on the mobile device signs authentication requests, and the server verifies these signatures using the user's public key. This intermediary cryptographic mechanism provides strong security while maintaining user-friendly operation, as users only need to possess their mobile device with the certificate store.
Data Source
AI summary
Techniques are disclosed for authenticating users to a computing application. A relying application transmits a login page to a user requesting access to the application. The login page may include a QR code (or other barcode) displayed to the user. The QR code may encode a nonce along with a URL address indicating where a response to the login challenge should be sent. In response, the user scans the barcode with an app on a mobile device (e.g., using a camera on a smart phone) to recover both the nonce and the URL address. The mobile device may also include a certificate store containing a private key named in a PKI certificate. The app signs the nonce using the private key and sends the signed nonce in to the URL in a response message.