Web Authentication Orchestration Using Localhost Origin Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web authentication protocols like WebAuthn are not universally supported across all browsers, making them vulnerable to attacker-in-the-middle (AITM) attacks, where attackers intercept communications to steal sensitive information.
Innovation Solution
A mobile application on the device orchestrates WebAuthn requests on behalf of the web browser, using a localhost listener to verify the origin header and proximity of the device, ensuring the request originates from a trusted domain and is co-located with the authenticating device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If WebAuthn protocol is implemented for authentication, then security against AITM attacks is improved, but browser compatibility deteriorates
Solution Approach 1:
The patent introduces a mobile application as an intermediary between the web browser and the authentication server. This orchestrator application handles WebAuthn requests on behalf of browsers that don't natively support the protocol, enabling secure authentication across incompatible browsers while maintaining security against AITM attacks through origin binding and proximity verification
Solution Approach 2:
The mobile application serves multiple functions: it acts as a WebAuthn orchestrator for browsers without native support, provides origin binding to prevent AITM attacks, performs proximity verification to ensure device co-location, and bridges communication between browsers and authentication servers. This multi-functionality resolves the contradiction by making the system universally applicable across different browsers while maintaining high security
2Reliability
If authentication protocol is added to prevent AITM attacks, then security is improved, but device complexity increases
Solution Approach 1:
The mobile application performs self-service by automatically handling the complex WebAuthn orchestration, origin binding validation, and proximity verification without requiring manual configuration or complex system setup. The application autonomously manages the authentication process, reducing the operational complexity burden on users while maintaining robust security
Solution Approach 2:
The patent merges multiple security functions (origin binding, proximity verification, WebAuthn orchestration) into a single mobile application. This consolidation reduces device complexity by combining what would otherwise be separate complex systems into one integrated solution that handles authentication securely and efficiently
Data Source
AI summary
In one embodiment, a method uses a web browser to receive an authentication request for an application from an authentication prompt of a client device. The method identifies an authentication protocol associated with web browser of the client device and use the authentication prompt to fetch a first challenge from an authentication service associated with the client device. The method uses the authentication prompt to communicate a subscribe to the authentication service and use a localhost to communicate to the application to provide the first challenge. In response to receiving the first challenge, the method uses one or more native Application Programming Interfaces (APIs) to determine an assertion associated with the authentication request and the authentication protocol. The method validates the assertion associated with the authentication request. In response to determining the assertion is valid, the method approves the authentication request.