Web Service Authentication Using Device Tokens and Biometrics

The patent introduces an intermediary authentication mechanism using device-specific tokens and biometric verification. Instead of directly entering credentials on the web page (which exposes them to keyloggers), the system uses a trusted device as an intermediary that holds the token and performs biometric authentication locally. This intermediary approach eliminates direct credential entry while maintaining ease of use through automated token presentation.

The patent replaces the mechanical keyboard input system (typing username and password) with biometric authentication (fingerprint, facial recognition, or other physiological traits). This substitution eliminates the vulnerability to keylogging while maintaining user convenience, as biometric authentication is as easy as the previous method but secure against credential theft.

The patent performs security verification in advance by binding device identifiers to user accounts during registration and authentication. The server pre-validates that the token originates from a registered device before processing the authentication request. This preliminary action eliminates the need for complex real-time fraud detection during login, maintaining security while improving processing efficiency.

The patent uses device identifiers (such as hardware IDs or device tokens) as immutable copies of the physical device's identity. These identifiers serve as reliable fingerprints that the server can verify without complex analysis. By copying and verifying these stable device characteristics, the system achieves secure authentication with minimal computational overhead compared to analyzing behavioral patterns or multiple verification steps.