Security Agent Device Identification Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity provider authentication systems face challenges in reliably identifying computing devices, as location data from IP addresses can be spoofed and device data from user agent strings can also be manipulated, leading to inaccurate security risk assessments.
Innovation Solution
The system employs a security agent on the computing device to intercept authentication requests and provide device data to a second identity provider, which then signs this data with a private key and returns it to the first identity provider, enhancing the accuracy of security risk evaluations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If location data from IP address or device data from user agent string is used for authentication, then the authentication process can proceed, but the reliability of device identification deteriorates due to spoofing
Solution Approach 1:
A security agent is introduced as an intermediary component installed on the computing device. This agent directly communicates with the identity provider to provide authenticated device data, eliminating reliance on spoofable identifiers like IP addresses or user agent strings. The security agent acts as a trusted mediator that establishes a direct, secure connection between the device and authentication system.
Solution Approach 2:
The patent replaces traditional network-based identification mechanisms (IP address, user agent strings) with a hardware-based security agent. This substitution moves from software/network-layer identification to a more secure, device-integrated approach that is difficult to spoof or manipulate.
2Ease of operation
If software package (browser extension) is used to provide device data, then device data can be obtained, but the ease of operation deteriorates due to installation requirements on every browser
Solution Approach 1:
The security agent is designed as a universal solution that operates across multiple browsers and operating systems through a single installation. Instead of requiring separate browser extensions for each browser, the security agent provides multi-functional support across different platforms, simplifying deployment and improving ease of operation.
3Measurement precision
If traditional authentication methods are used, then the authentication process is simple, but the measurement precision of device identification deteriorates
Solution Approach 1:
The security agent performs preliminary actions by establishing secure connections and providing authenticated device data before the actual authentication decision is made. This preliminary provision of reliable device identifiers enables the identity provider to accurately assess device identity and make informed authentication decisions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques and systems are described for enabling an identity provider to identify a computing device during authentication of a user that uses the computing device, and to do so in a manner that is independent of a browser and/or a client application and/or an operating system on the computing device. For example, upon receiving, from a first identity provider, redirection data to redirect an authentication request to a second identity provider, a security agent executing on the computing device may intercept the authentication request, retrieve data about the computing device, and send the authentication request with the device data to the second identity provider. Upon receiving, from the second identity provider, a signed response to the authentication request, the computing device may send the signed response to the first identity provider to receive a result of the authentication request from the first identity provider.