One-Touch Login IP Verification Against Token Theft
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current one-touch login service lacks sufficient security, leading to easy disclosure of user private data due to unauthorized access and token theft.
Innovation Solution
Implement IP address verification and encryption mechanisms to ensure that the terminal device accessing the service is the same before and after token transmission, using symmetric keys to secure communication and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If one-touch login method is implemented without IP verification, then user convenience is improved (login time reduced to 2 seconds), but security deteriorates (user private data easily disclosed)
Solution Approach 1:
The system performs preliminary IP address verification before token transmission. The operator server records the IP address of the terminal device before sending the token, and later verifies that the IP address remains consistent when the token is transmitted to the application server. This preliminary action prevents token theft and unauthorized access while maintaining the convenience of one-touch login.
Solution Approach 2:
The patent introduces IP address verification as an intermediary security mechanism between the application client device and the application server. The operator server acts as a mediator that checks IP address consistency before allowing token transmission, thereby protecting user private data without compromising the ease of operation.
2Speed
If token transmission is performed without IP address verification, then login speed is maintained (approximately 2 seconds), but data security deteriorates (private data easily disclosed)
Solution Approach 1:
The system performs preliminary IP address recording and verification before token transmission. The operator server records the IP address of the terminal device before sending the token, and later verifies that the IP address remains consistent when the token is transmitted to the application server. This preliminary action prevents token theft and unauthorized access while maintaining the speed of login.
Solution Approach 2:
The system implements feedback mechanism where the operator server checks the IP address consistency and provides feedback to the application server. If the IP address changes between token issuance and transmission, the system rejects the request, thereby ensuring data security without significantly impacting login speed.
3Reliability
If IP address verification is implemented, then security is improved (unauthorized access prevented), but system complexity increases (additional verification steps required)
Solution Approach 1:
The patent introduces IP address verification as an intermediary security mechanism between the application client device and the application server. The operator server acts as a mediator that checks IP address consistency before allowing token transmission, thereby protecting user private data without significantly complicating the overall system architecture.
Solution Approach 2:
The system adds IP address as a new verification parameter to the existing one-touch login process. By changing the verification parameter from merely token-based to IP address + token-based verification, the system enhances security without requiring fundamental architectural changes, thus managing system complexity effectively.
Data Source
AI summary
Computer-implemented methods, non-transitory, computer-readable media, and computer-implemented systems implementing a one-touch login service are described. Information about a first IP address is obtained from a verification request sent by an application client device. A token is sent to the application client device. Information about a second IP address is obtained from a number acquisition request sent by an application server. Whether the first IP address is the same as the second IP address is determined. If the same, based on a token carried in the number acquisition request, a mobile phone number of a terminal device in which the application client device is located is obtained and the mobile phone number is sent to the application server. If not the same, sending the mobile phone number of the terminal device to the application server is refused.