Security Server Authentication via Separate Channel
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current site and user authentication methods on the web are vulnerable to counterfeit sites and attacks, such as man-in-the-middle and man-in-the-browser attacks, and require users to be proactive or install toolbars, while existing SSL infrastructure is confusing and ineffective.
Innovation Solution
A system that uses a pop-up window communicating with a security server through a separate channel to verify site authenticity, providing visual cues and random images, and enables user authentication with one-time passwords based on shared secrets between the security server and web sites, eliminating the need for per-user secrets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL infrastructure is used for site authentication, then security is provided, but user experience becomes confusing and complex
Solution Approach 1:
The patent introduces a seal server as an intermediary component that mediates between the website and the user's browser. The seal server generates and manages authentication seals, handling the complex cryptographic operations behind the scenes while presenting a simple visual seal to the user. This intermediary absorbs the complexity of SSL verification, leaving users with a straightforward visual confirmation.
Solution Approach 2:
The patent creates a visual copy or representation of authentication status through the seal image. Instead of requiring users to interpret complex SSL certificates, error messages, and cryptographic protocols, the system generates a simple visual seal that copies the essential authentication information in an easily digestible format. The seal serves as a simplified representation of the underlying security mechanism.
2Ease of operation
If site seals are made easily visible, then user comfort increases, but counterfeit seals become easier to create
Solution Approach 1:
The system performs preliminary authentication actions before the seal is displayed to the user. The seal server verifies the website's credentials and generates the authentication seal in advance, before presenting it to the user. This preliminary verification ensures that only authenticated sites receive seals, preventing counterfeit seals from being created later. The complex verification happens upfront, leaving only the simple visual seal for the user.
Solution Approach 2:
The seal server acts as an intermediary that controls seal generation and distribution. Rather than allowing websites to self-generate seals or users to verify complex certificates, the seal server mediates the entire process. It validates website credentials, generates unique seals, and distributes them through a controlled mechanism, preventing counterfeit seal creation while maintaining user comfort.
3Reliability
If per-user secrets are used for one-time password authentication, then security is improved, but system complexity and provisioning requirements increase
Solution Approach 1:
The patent implements a universal authentication mechanism where a single shared secret between the relying party and the authentication server serves multiple users. Instead of requiring separate per-user secrets, the system uses one secret that enables authentication for any user through the authentication server's mediation. This universal approach maintains security while eliminating the complexity of provisioning and managing individual secrets for each user.
Solution Approach 2:
The authentication server provides self-service functionality by dynamically generating one-time passwords for users without requiring manual provisioning of per-user secrets. When a user needs to authenticate, the server automatically generates the necessary credentials based on the shared secret and user identity. This self-service mechanism eliminates the administrative burden of secret management while maintaining strong authentication security.
Data Source
AI summary
User authentication is achieved by creating a window on the user's PC that is in communication with a security server, where this communication channel is separate from the communication channel between the user's browser and whichever web site they are at. A legitimate web site embeds code in the web page which communicates to the security server from the user's desktop. The security server signals both the web page on the user's browser and the window to which it has a separate channel. If user authentication is requested by the web site, the security server computes a one time password based on a secret which it shares with the web site, but not with the user, and which is not associated with any particular user, and the web site can re-compute the one time password to authenticate the user.