Mobile Device Token Validation Bypassing Proof-of-Work Tests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for providing application services to mobile communication devices in wireless networks often require inconvenient challenge-response tests, such as Captcha, to differentiate between human and automated software, which can hinder efficient access for trusted devices.
Innovation Solution
A mobile communication device operates in a wireless network with a service provider, using a message with a token having a digital signature that is validated by the application server, allowing trusted devices to bypass proof-of-work tests like Captcha, thereby granting convenient access to application services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If challenge-response tests like Captcha are used to differentiate between human and automated software, then security against automated software is improved, but ease of operation deteriorates due to inconvenient access for trusted devices
Solution Approach 1:
The system performs preliminary verification by checking whether the user agent string matches known mobile device patterns before requiring challenge-response tests. This preliminary action identifies trusted mobile devices early in the authentication process, allowing them to bypass subsequent Captcha tests and proceed directly to service access, thereby resolving the contradiction between security and ease of operation
Solution Approach 2:
The system applies different authentication requirements to different types of users based on their user agent characteristics. Mobile devices with specific user agent strings are granted differentiated treatment (exemption from Captcha) compared to other users who must complete challenge-response tests. This local quality approach allows the system to maintain high security for untrusted users while providing convenient access to trusted mobile devices
2Reliability
If proof-of-work tests are required for all users, then protection against automated software is improved, but productivity deteriorates due to time-consuming authentication for legitimate users
Solution Approach 1:
The system performs preliminary identification of mobile devices through user agent string analysis before requiring proof-of-work tests. This preliminary action enables the system to skip unnecessary Captcha challenges for trusted mobile devices, thereby improving access efficiency and productivity without compromising protection against automated software for other user types
Solution Approach 2:
The system applies proof-of-work tests selectively rather than universally. By requiring Captcha only for users whose user agent strings do not match mobile device patterns, the system performs partial verification action that is sufficient for security needs while avoiding excessive authentication steps for legitimate mobile users, thus improving overall productivity
Data Source
AI summary
A technique in a mobile device which is configured to communicate in a wireless network with use of a communication service provided by a service provider is described. The mobile device is configured to access via the wireless network a server for execution of an e-commerce transaction. The server is configured to administer a proof-of-work test in order to allow completion of the e-commerce transaction. The mobile device receives via the wireless network a token from a token server. The token is digitally signed by the service provider with a digital signature thereof. The mobile device sends via the wireless network a message to the server, and this message includes the token. When token validation of the message at the server is successful, the mobile device completes the e-commerce transaction with the server without performing the proof-of-work test, which is bypassed for the mobile device.