Password-Free Proxy Login via Dual Token Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-free login methods between websites are insecure as they rely solely on the destination website's security capabilities, posing a risk due to varying protection levels among payment websites during inter-site transactions.
Innovation Solution
Implementing a dual authentication method where both the originating and destination websites perform security verification during password-free proxy login, using tokens and device fingerprints to ensure secure transitions without requiring users to enter credentials manually.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If password-free proxy login is implemented relying solely on the destination website's security capabilities, then the login procedure is simplified and user experience is improved, but the security of the login process deteriorates due to varying protection levels among different websites
Solution Approach 1:
The patent introduces a token mechanism as an intermediary between the originating website and destination website. The token, generated by the originating website after verifying user credentials, serves as a mediator that carries authentication information securely. This intermediary allows the destination website to verify user authenticity without directly relying on its own security capabilities alone, thus resolving the contradiction between simplified login and security.
Solution Approach 2:
The originating website performs preliminary security verification by validating user credentials and generating an authenticated token before the user reaches the destination website. This preliminary action ensures that security checks are completed in advance, allowing the destination website to accept the token without performing redundant security checks, thereby maintaining both security and operational simplicity.
2Reliability
If manual credential entry is required for each website jump, then login security is maintained through direct authentication, but the operation complexity and time consumption increase significantly
Solution Approach 1:
The system implements self-service authentication where the originating website automatically handles credential verification and token generation without requiring manual intervention for each website jump. The user credentials are verified once by the originating website, and the resulting token is automatically accepted by the destination website, eliminating the need for repeated manual credential entry while maintaining security.
Solution Approach 2:
The authentication process is made continuous through the token mechanism. Once the user is authenticated by the originating website, the authentication state is maintained and transferred via the token to the destination website. This continuous authentication flow eliminates the need to restart the login process at each website jump, reducing operational complexity while preserving security through the unbroken authentication chain.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present application provides a website login method and apparatus, and the method includes: when a first website receives a website jump trigger, obtaining a first token stored in cookies of a browser that the first website runs on, where the first token includes a website identifier of a second website on a second website list page indicated by the website jump trigger, and a device fingerprint used to indicate a running environment where password-free proxy login is set for the second website; if the first website determines, based on the device fingerprint, that a current running environment is the same as the running environment where password-free proxy login is set for the second website, obtaining, by the first website, a second token that corresponds to the first token; and sending, by the first website based on the website identifier in the first token, a password-free login request including a third token to the second website, where the third token includes the second token; and logging in to the second website without a password when the second website successfully verifies the second token. Security of password-free login of the second website through the first website is improved in the present application.