Server Challenge-Response Authentication for Hybrid Mobile Apps

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Hybrid mode mobile applications expose back-end servers to unauthorized access due to the ability of attackers to inspect and modify JavaScript code, lacking effective mechanisms to validate application authenticity without native code implementation.

Innovation Solution

A method where the server sends a challenge string to the client, which executes and converts it into a command, allowing the server to validate the authenticity of the application by executing the resulting function without requiring native code, thereby determining whether to permit or deny access to server functions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If JavaScript code is used in hybrid mode mobile applications, then cross-platform development is simplified, but back-end servers are exposed to unauthorized access due to code inspection and modification by attackers

Engineering Contradiction:

Improvecross-platform development simplicityVSAvoidserver security against unauthorized access

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The system performs preliminary authentication by sending a challenge string to the client application before granting server access. The client must execute this challenge and return a valid response, proving authenticity in advance. This preliminary action prevents unauthorized access before it can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary authentication mechanism between the client application and the server. Instead of direct access, the server uses an authentication framework that mediates communication, validating the client's authenticity through challenge-response protocols before allowing any server function calls.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If native code implementation is used to check application authenticity, then server security is improved, but device compatibility and ease of operation are reduced

Engineering Contradiction:

Improveapplication authenticity validationVSAvoidcross-platform compatibility

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The authentication framework is designed to be universal and framework-agnostic, working with any mobile application framework (Native, Hybrid, WebView, etc.) without requiring framework-specific native code. The same authentication mechanism can be deployed across different platforms and framework types, providing multi-functionality and broad compatibility.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent replaces the mechanical approach of using native code implementations with a software-based authentication framework that operates through standardized string communication. Instead of relying on platform-specific native libraries, the system uses universal JavaScript-compatible challenge-response protocols that can be executed across all mobile platforms without native code dependencies.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If JavaScript code is deployed with the application, then deployment flexibility is improved, but code security is worsened due to attacker ability to inspect and write unauthorized applications

Engineering Contradiction:

Improvedeployment flexibilityVSAvoidcode inspection and unauthorized modification

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the authentication logic from the deployed JavaScript code and moves it to the server side. The challenge string is generated and validated on the server, while the client only needs to execute the challenge and return the response. This extraction removes the sensitive authentication logic from the client-side code that attackers can inspect.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent converts the harmful ability of JavaScript interpretability into a benefit. While JavaScript's interpretability allows attackers to inspect code, the same interpretability enables the client to dynamically execute server-provided challenge strings and generate responses. The system turns the potential vulnerability of code inspection into a feature where the client can flexibly execute any challenge without needing pre-hardcoded authentication logic.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS10574642B2Protecting a web server against an unauthorized client application

Publication Date: 2020.02.25 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

An approach is provided for securing communication between a server computer and a client computer. A first string is sent to the client in response to a request to permit an application being executed by the client computer to access a first function. A second string that includes a parameter of a second function is received. The second string is a result of a conversion of the first string to a command and an execution of the command by the client. A result of an execution of the second function is matched with code information obtained from files of the application. Based on the match to the result of the execution of the second function and without requiring an implementation of native code which checks the authenticity of the application, the server validates the authenticity of the application and permits the application to access the first function.