Trusted Hardware Component Authentication via Cryptographic Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for secure network access of user accounts rely on reusable credentials like usernames and passwords, which are vulnerable to phishing attacks and compromise security.
Innovation Solution
A system utilizing a mobile device with a trusted hardware component to authenticate transactions through cryptographic keys and biometric verification, eliminating the need for traditional credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional username and password authentication is used, then the authentication process is simple and familiar to users, but the system becomes vulnerable to phishing attacks and credential compromise
Solution Approach 1:
The patent replaces the mechanical credential verification system (username/password typing and checking) with a cryptographic system using public-key infrastructure. The mobile device generates cryptographic key pairs, and the server verifies signatures using public keys, eliminating the need for users to remember passwords and protecting against phishing attacks.
Solution Approach 2:
The patent implements preliminary registration where cryptographic key pairs are generated in advance and registered with the server before actual authentication is needed. This preliminary setup allows for secure, rapid authentication later without requiring users to remember credentials, resolving the contradiction between security and simplicity.
2Reliability
If cryptographic keys and biometric verification are implemented, then security against phishing attacks is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The mobile device automatically performs cryptographic operations including key generation, signature creation, and secure key management without requiring user intervention for complex cryptographic tasks. The biometric authentication is handled automatically by the device, making the secure authentication process as easy as touching or looking at the device.
Solution Approach 2:
The mobile device acts as an intermediary between the user and the server, handling all cryptographic operations locally. The device signs challenges and manages key pairs, shielding the user from cryptographic complexity while providing strong security through hardware-based key protection.
3Device complexity
If reusable credentials like passwords are used, then the authentication system is easy to implement, but the system is vulnerable to compromise and phishing
Solution Approach 1:
The patent uses short-lived cryptographic tokens and challenges instead of long-term reusable passwords. Each authentication session uses a new cryptographic challenge that is signed and then discarded, eliminating the value of stolen credentials for future attacks and making phishing ineffective.
Solution Approach 2:
The patent replaces the password-based authentication mechanism with cryptographic signature verification. Instead of comparing plaintext or hashed passwords, the server verifies digital signatures using public keys, providing security that cannot be compromised through phishing or credential theft.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
A computing device receives, from a first client device, a request for a security token to authenticate a transaction session for a user account administered by a network resource, the first client device being associated with the user account. In response to the request, the computing device generates and sends a security token to the first client device, which communicates the security token to a second client device. The computing device receives, from the second client device, a modified security token that includes the security token and a signature on the security token using a first key stored in a trusted hardware component coupled to the second client device. A second key corresponding to the first key is registered with the network resource. The computing device verifies the modified security token using the second key. Upon successfully verifying the modified security token, the computing device enables the transaction session.