Application Authentication via Push Key Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In digital distribution systems, legitimate applications can be spoofed, allowing nefarious actors to access back-end services and sensitive information, as existing security measures like application keys can be decompiled, rendering them ineffective.
Innovation Solution
A provider system uses a digital distribution system to send a short-term shared key to the client device, ensuring only legitimate applications can access resources by verifying the authenticity of the provider client application through a push communication protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application keys are used for authentication, then application identity verification is enabled, but the security protection is insufficient because keys can be decompiled and mimicked
Solution Approach 1:
The patent extracts the authentication mechanism from the application code itself and relocates it to the operating system kernel level. The authenticator is separated from the application binary, preventing extraction through decompilation. The authentication key is stored in a protected system location rather than embedded in the application, making it inaccessible to reverse engineering tools.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism between the application and backend services. The operating system acts as a mediator that verifies application authenticity through system-level checks before allowing access to backend services. This intermediary layer prevents direct authentication bypass even if application keys are compromised.
2Ease of operation
If traditional authentication methods are used, then application access to back-end services is enabled, but the system cannot distinguish between legitimate and nefarious applications
Solution Approach 1:
The patent implements preliminary authentication checks at system startup and before granting access to backend services. The authenticator verifies application legitimacy in advance through multiple checks including code signing verification, hash validation, and system registry checks. This preliminary action ensures that only authenticated applications can access protected resources.
Solution Approach 2:
The patent implements a feedback mechanism where the authenticator continuously monitors application behavior and verifies authentication status. The system provides feedback to the kernel and application lifecycle management components about authentication state, enabling dynamic access control decisions based on real-time verification results.
3Device complexity
If application keys are embedded in software, then authentication functionality is integrated, but the keys can be accessed and mimicked by nefarious actors
Solution Approach 1:
The patent segments the authentication system into distinct components: the authenticator module, the key storage system, the verification mechanism, and the application interface. Each component resides in a separate protected space within the operating system. This segmentation prevents comprehensive extraction of authentication credentials through decompilation, as each component is protected independently and requires multiple authorized access points to function.
Data Source
AI summary
Techniques are provided for client application authentication and include receiving a request to authenticate an application and, based on the received request to authenticate the application, sending a request to perform a push communication, including a short-term shared key, to a digital distribution system, wherein the digital distribution system is a distribution source of the application. The digital distribution system attempts to send the push communication including the short-term shared key to the application. The techniques may proceed by receiving a request for resources from the provider client application and determining whether the application has the short-term shared key. When it is determined that the application has provided the short-term shared key, the requested resources to the application may be provided, otherwise, the requested resources may be denied.