WebRTC Identity Management via Trusted Intermediary

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current WebRTC identity management mechanisms, such as OAuth2.0 and BrowserID, insecurely transmit user identities, allowing third parties to intercept and misuse authorization codes, compromising user identity verification.

Innovation Solution

A method and system for securely managing user identities by associating a user's identity with a data item characteristic of another user, ensuring that the identity is only made available to the authorized user who possesses a corresponding data item, using a trusted entity and asymmetric key pairs for authentication and encryption.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If user identities are transmitted using current WebRTC mechanisms (OAuth2.0, BrowserID), then identity exchange functionality is enabled, but security is compromised allowing third-party interception

Engineering Contradiction:

Improveidentity verification securityVSAvoidthird-party interception of authorization codes

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the identity verification process from the public signaling channel and moves it to a private encrypted channel between the user's browser and the identity provider. This separation removes the vulnerability where authorization codes were transmitted in clear text through the signaling server, allowing third parties to intercept them. The identity proof is now obtained directly from the identity provider via secure connection, eliminating the interception risk.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces the identity provider as a trusted intermediary that directly establishes secure communication with the user's browser. Instead of relying on the signaling server to transmit identity information, the identity provider acts as a mediator that issues identity proofs directly to the authenticated user through a private channel. This intermediary mechanism ensures that only the legitimate user receives the identity verification data, preventing third-party interception.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If authorization codes are transmitted through signaling messages, then user authentication is enabled, but the codes become vulnerable to interception and misuse

Engineering Contradiction:

Improveauthentication processVSAvoidauthorization code security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent extracts the authorization code transmission from the public signaling message exchange and relocates it to a private encrypted communication channel between the browser and identity provider. This extraction removes the security vulnerability where authorization codes were exposed in clear text during the authentication process, while maintaining the ease of operation by keeping the authentication flow simple and direct.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of transmitting the actual authorization code through the signaling channel, the patent uses a copy or representation of the identity proof that is generated and delivered directly to the user's browser through secure connection. The identity provider creates a localized copy of the authentication credential that resides only in the user's browser, eliminating the need to transmit sensitive codes through potentially insecure channels.

Inventive Principle:

Principle #26Copying

3Loss of information

If identity certificates are exchanged via signaling messages, then user identification is achieved, but the exchange lacks cryptographic protection

Engineering Contradiction:

Improveidentity information exchangeVSAvoidcryptographic security of identity exchange

Core Design Contradiction:

Loss of informationVSReliability

Solution Approach 1:

The patent introduces a private encrypted communication channel as an intermediary mechanism between the identity provider and the user's browser. This intermediary channel provides cryptographic protection for the identity certificate exchange, ensuring that identity information is transmitted securely without exposure to eavesdropping or tampering. The signaling server is bypassed for this sensitive exchange, and direct secure communication is established through the identity provider.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11146536B2Method and a system for managing user identities for use during communication between two web browsers

Publication Date: 2021.10.12 ORANGE SA

AI summary

A management method for managing an identity of a first user during communication between a first web browser installed on a communication terminal of the first user and a second web browser installed on a communication terminal of a second user is disclosed. The method includes the first user obtaining at least one first data item characteristic of the second user. The method also includes associating an identity of the first user with the at least one first data item characteristic of the second user. The method also includes making the identity of the first user associated with the at least one first characteristic data item available to the second user on condition that the second user holds at least one second data item corresponding to the first data item characteristic of the second user.