Non-Custodial dApp Authentication With Client-Side Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods, such as username/email/phone + password, are insecure and cumbersome, prone to leaks, and difficult to recover from, leading to unauthorized access and financial loss.
Innovation Solution
A non-custodial authentication system using public-private key pairs generated on a client machine, encrypted by a third-party platform, and managed by remote hardware security modules to secure user identity and authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username/email/phone + password security model is used, then user authentication is simple to implement, but security is compromised due to password leaks and brute-force attacks
Solution Approach 1:
The patent replaces the mechanical password-based authentication system with a cryptographic system using public-private key pairs. Instead of relying on passwords that can be stolen or brute-forced, the system uses cryptographic keys where the private key never leaves the user's device and the public key is used for authentication, fundamentally substituting the authentication mechanism to achieve both high security and acceptable complexity
Solution Approach 2:
The patent introduces a key management service as an intermediary that facilitates key generation, storage, and authentication without centralizing sensitive data. This mediator enables secure authentication by coordinating between the user's device and application servers while maintaining cryptographic security, resolving the contradiction between simple implementation and security requirements
2Reliability
If centralized key management system is used, then key storage and management is simplified, but security is reduced due to single point of failure and centralized attack target
Solution Approach 1:
The patent segments the key management functionality across multiple components: local key generation on user devices, distributed key storage in secure enclaves, and decentralized authentication verification. This segmentation eliminates the single point of failure inherent in centralized systems while maintaining operational simplicity through standardized interfaces and protocols
Solution Approach 2:
The patent implements local key generation and storage within secure enclaves on user devices, giving each user independent control over their cryptographic keys. This local quality approach ensures that even if one user's device is compromised, other users' keys remain secure, achieving both high security and ease of operation through localized security boundaries
3Reliability
If password-based authentication is used, then user sessions can be maintained after authentication, but security is compromised as sessions can be hijacked
Solution Approach 1:
The patent replaces password-based session management with cryptographic signature verification. Instead of maintaining session states that can be hijacked, the system uses digital signatures where each request is independently authenticated using the user's private key, eliminating session hijacking risks while maintaining smooth user experience through stateless authentication
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A mechanism for building decentralized computer applications that execute on a distributed computing system. The present technology works within a web browser, client application, or other software and provides access to decentralized computer applications through the browser. The present technology is non-custodial, wherein a public-private key pair, which represents user identity, is created on a client machine and then directly encrypted by a third-party platform without relying on one centralized computing system.