Push Authentication Security via End-to-End Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing push authentication systems lack adequate security, particularly in transmitting sensitive information, as they may expose data to unprotected channels and allow strong authentication providers to access authentication contents, raising privacy concerns.
Innovation Solution
Implementing a computer-implemented method that uses end-to-end encryption with public keys, challenge-response questions, and dynamic knowledge-based authentication to secure push authentications, ensuring that only the user's endpoint device can decrypt the core message, thereby preventing intermediaries from accessing the content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If push authentications are transmitted using traditional methods, then the authentication process is simple, but the sensitive information is exposed to unprotected channels and intermediaries
Solution Approach 1:
The patent introduces a security service as an intermediary that facilitates secure communication between the relying party and the client device. This intermediary manages the encryption infrastructure, including key distribution and certificate validation, allowing secure push authentication without requiring the relying party to implement complex cryptographic systems themselves. The security service acts as a trusted mediator that resolves the contradiction between security and simplicity.
Solution Approach 2:
The patent segments the authentication system into distinct functional components: the relying party that initiates authentication, the security service that manages cryptographic operations, and the client device that receives and processes push notifications. This segmentation allows each component to have specialized, optimized functionality - the security service handles the complex encryption/decryption operations while the relying party maintains simplicity, thus resolving the contradiction between security requirements and system simplicity.
2Reliability
If strong authentication providers are used to secure push authentications, then security is improved, but the authentication providers can decrypt and access the push authentication contents
Solution Approach 1:
The patent implements preliminary action by having the client device generate its own cryptographic key pairs before interacting with the authentication system. The public keys are registered with the security service in advance, establishing a trusted relationship. When push notifications are sent, they are encrypted with the client device's public key, ensuring that only the intended recipient can decrypt them. This preliminary key establishment prevents the authentication provider from accessing contents, as the encryption keys never pass through the provider's control.
Solution Approach 2:
The patent applies local quality by giving each client device its own unique cryptographic key pair, creating individualized security zones. Each device's private key remains locally stored and never leaves the device, while the corresponding public key is distributed to authorized parties. This localization of cryptographic credentials ensures that even the authentication provider cannot decrypt messages intended for specific devices, as the decryption capability remains exclusively local to each device.
Data Source
AI summary
The disclosed computer-implemented method for securing push authentications may include (i) receiving, by a security service and from a security service relying party, a push authentication for a user that the security service relying party encrypted using a public key assigned to a client device of the user, (ii) forwarding, by the security service, the push authentication to the client device of the user, (iii) receiving, by the security service, a response to the push authentication from the client device of the user, and (iv) forwarding, by the security service, the response to the push authentication from the client device of the user to the security service relying party. Various other methods, systems, and computer-readable media are also disclosed.