Token Server Authentication via Cross-Application Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional token acquisition methods are vulnerable to session hijacking, especially on mobile devices, due to their wireless nature and susceptibility to malicious plug-ins, allowing unauthorized access to resources.
Innovation Solution
A token server delivers tokens to mobile devices running both browser and security applications, comparing device information from both sources to ensure consistency before authorization, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a mobile device uses a browser application to access services, then ease of operation is improved, but security is worsened due to vulnerability to session hijacking and malicious plug-ins
Solution Approach 1:
The system segments the authentication process into two independent parts: the browser application handles service access requests while a separate security application independently verifies device identity and collects authentication factors. This segmentation prevents the browser from being a single point of failure against session hijacking, as the security application operates independently to validate the device's true identity before tokens are issued.
2Device complexity
If a token server relies solely on device information from the browser, then device complexity is reduced, but security is worsened due to susceptibility to malicious plug-ins
Solution Approach 1:
The security application acts as an intermediary between the browser and the token server. It independently collects authentication factors and device information, then provides this verified data to the token server. This intermediary layer prevents malicious browser plug-ins from directly manipulating the authentication process, as the security application validates all information before forwarding it.
3Reliability
If the token server compares device information from multiple independent sources, then security is improved, but device complexity increases due to requiring multiple applications
Solution Approach 1:
The security application serves multiple functions: it collects authentication factors, verifies device identity, and communicates with the token server. By consolidating these security-related tasks into a single multi-functional application, the system achieves enhanced security without proportionally increasing complexity, as the security application replaces what would otherwise require multiple separate security components.
Data Source
AI summary
A technique performs authentication before delivering a token to a client device. The technique involves receiving a first message from a first application on the client device, the first message including a token request and a first set of authentication factors. The technique further involves receiving a second message from a second application on the client device, the second message including an authentication request and a second set of authentication factors. The technique further involves generating a result message which (i) provides access to a token for use by the client device when the first set of authentication factors is consistent with the second set of authentication factors, and (ii) rejects the token request when the first set of authentication factors is inconsistent with the second set of authentication factors. The client device may be a mobile device, and the first and second messages may be received via wireless communications.