Salted Password Authentication with Device and Browser Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication systems relying on usernames and passwords are vulnerable to unauthorized access, as hackers can obtain these credentials, and two-factor authentication is also susceptible to compromise if the associated email or phone is intercepted.
Innovation Solution
The system salts a password with a browser identifier and user device identifier, creating a salted password that is transmitted for authentication, allowing the system to verify the password, device, and browser, thereby granting or denying access based on matching stored credentials beyond a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional username and password authentication is used, then ease of operation is improved, but security is worsened because hackers can obtain credentials
Solution Approach 1:
The authentication system segments the credential verification into multiple independent components: device identifier verification, browser identifier verification, and password verification. Each component must match independently, so that compromising one element (the password) does not lead to full system compromise. This is achieved by comparing the submitted device ID, browser ID, and password against stored values for the legitimate user.
Solution Approach 2:
The patent introduces device identifiers and browser identifiers as intermediary verification elements between the user and the authentication system. These intermediaries act as additional layers that must be validated alongside the password, creating a mediated authentication process where all elements must align for successful access.
2Reliability
If two-factor authentication via email or phone is implemented, then security is improved, but reliability is worsened if the email or phone is intercepted by hackers
Solution Approach 1:
Instead of relying on communication channels (email, phone) that can be intercepted, the system creates a copy-based verification mechanism using device identifiers and browser identifiers. These identifiers are copied from the legitimate user's registered device and browser, and the authentication system verifies that the submitted copies match the stored originals, bypassing vulnerable communication channels entirely.
3Reliability
If password salting with device and browser identifiers is implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent merges the device identifier, browser identifier, and password into a single integrated authentication verification process. Rather than treating them as separate complex systems, the authentication system combines all three elements into one unified credential set that is stored and verified together, simplifying the overall architecture while maintaining enhanced security.
Solution Approach 2:
The authentication system is designed with multi-functionality to handle multiple verification types (device ID matching, browser ID matching, password matching) within a single unified process. This universal approach allows the same authentication mechanism to verify all three credential types without requiring separate specialized systems for each, reducing overall complexity.
Data Source
AI summary
The disclosed systems and methods may receive a first salted password having a first password, a first user device identifier, and a first browser identifier, extract the first password, the first user device identifier, and the first browser identifier from the first salted password, and determine whether the first password, the first user device identifier, and the first browser identifier respectively match a stored first password, a stored first user device identifier, and a stored first browser identifier. The systems may grant the request to access the one or more resources for the first user device or perform other actions depending on whether the first password, the first user device identifier, and the first browser identifier respectively match the stored first password, the stored first user device identifier, and the stored first browser identifier.