OAuth Agent Prevents Phishing via Digital Signature Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Phishing attacks during OAuth login processes are challenging to prevent, as users are often tricked into entering credentials on fake login screens that appear legitimate, allowing unauthorized access to their data.

Innovation Solution

An agent-based system that authenticates third-party client applications by generating and verifying application-specific one-time passwords (AOTPs) based on registered digital signatures, eliminating the need for users to enter credentials directly and ensuring only authentic applications access user data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If users manually enter credentials on OAuth login pages redirected by third-party applications, then the OAuth authorization process can be completed, but users are vulnerable to phishing attacks where fake login screens solicit credentials

Engineering Contradiction:

Improvesecurity against phishing attacksVSAvoiduser authentication process

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an agent as an intermediary component that sits between the user and the OAuth login process. This agent automatically verifies the authenticity of the login page and manages credential entry, eliminating the need for users to manually interact with potentially fake login screens while maintaining secure authentication

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The agent performs self-service by automatically detecting phishing attempts and handling authentication without requiring user intervention. The system monitors the OAuth flow, verifies application identities, and manages credential submission autonomously, freeing users from manual authentication tasks while enhancing security

Inventive Principle:

Principle #25Self-service

2Adaptability or versatility

If third-party applications can redirect users to login screens, then OAuth authorization functionality is enabled, but phishing applications can generate fake login screens to steal credentials

Engineering Contradiction:

ImproveOAuth authorization capabilityVSAvoidphishing attack vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The agent performs preliminary verification of the third-party application's identity before allowing the OAuth authorization to proceed. By checking the application's digital signature and verifying its authenticity in advance, the system prevents phishing applications from generating fake login screens, while still enabling legitimate OAuth functionality

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the agent continuously monitors the OAuth authorization flow and verifies application identities in real-time. This feedback loop detects and blocks phishing attempts while allowing legitimate OAuth operations to complete successfully

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10834074B2Phishing attack prevention for OAuth applications

Publication Date: 2020.11.10 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An example operation may include one or more of obtaining a request to validate an application with respect to an OAuth provider, identifying a previously registered digital signature of the application, generating verification information of the application based on the identified digital signature of the application, and passing the generated verification information of the application to the OAuth provider via a user login page.