Password-less Login Pairing via Network Service and QR Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password-based authentication methods are cumbersome and vulnerable to security threats, particularly in environments without Bluetooth Low Energy (BLE) capability, as users must manage multiple usernames and passwords and are susceptible to keystroke tracking and phishing attacks.
Innovation Solution
A system and method for securely pairing a mobile device with a computing device using a network service, where a pairing request is sent to a network server with computer authentication data and a public key, generating a pairing secret key and QR image, and using asymmetric encryption to encrypt and decrypt login passwords, ensuring end-to-end security without relying on BLE.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Bluetooth Low Energy (BLE) is used for proximal detection and device pairing, then password-less login can be implemented securely, but the solution becomes incompatible with computing devices that lack BLE capability
Solution Approach 1:
The patent introduces a network server as an intermediary component that mediates the pairing process between the mobile device and computing device. Instead of requiring direct BLE communication, the network server receives pairing requests, generates cryptographic key pairs, and facilitates secure key exchange over network connections. This intermediary approach enables devices without BLE capability to participate in the password-less login system while maintaining security through cryptographic protocols.
2Reliability
If multiple usernames and passwords are required for different computing devices, then account security can be maintained, but user convenience and ease of operation deteriorate
Solution Approach 1:
The patent implements a self-service mechanism where the mobile device automatically performs authentication functions. The mobile device stores cryptographic keys and automatically generates authentication tokens or approves login requests without requiring the user to manually enter passwords. The system serves itself by using the mobile device as a persistent authentication credential, eliminating the need for users to remember and manage multiple passwords across different devices.
3Reliability
If password-based authentication is used, then user credentials can be verified, but vulnerability to keystroke tracking and phishing attacks increases
Solution Approach 1:
The patent replaces the mechanical act of typing passwords with cryptographic authentication mechanisms. Instead of relying on users to physically enter passwords that can be captured by keystroke tracking software or phishing sites, the system uses cryptographic key pairs and digital signatures. The mobile device signs authentication requests cryptographically, and the computing device verifies these signatures, completely eliminating the need for password entry and thus removing the attack surface for keystroke tracking and phishing.
Data Source
Figure 1
Figure 2A-1~2A-2
Figure 2B~2C
AI summary
A system and method for pairing a mobile device with a computer for password-less login using a network service is provided. The method may include sending a pairing request to a network server from a computing device, wherein the pairing request includes computer authentication data and a computer public key. The network server may pair the mobile device with the computing device; wherein, the computing device may generate a pairing secret key and an associated QR image, which the user is prompted to scan using the mobile device. A pairing agent within the mobile device may validate the computer authentication data and parse the computer public key therefrom. In some embodiments a PIN could be displayed by the computer and entered by the user into the mobile device or silently exchanged between the computer and the mobile device, when proximate to each other, for the mutual authentication data validation. The method may further include registering the user mobile and computer devices for administrative management at the network server for an enterprise deployment or end user self-service management.