Webview Endpoint Authentication Using Cookie Equivalence Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, particularly multi-factor authentication (MFA), are vulnerable to second factor phishing attacks where a bad actor gains access by intercepting and forwarding authentication links, bypassing security measures.
Innovation Solution
An authentication server generates a randomly assigned cookie for each authentication request, transmitted via a browser link, and verifies its equivalence upon receipt to ensure the link originates from a trusted endpoint, preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication links are transmitted via browser to enable user access, then ease of operation is improved, but security is worsened due to vulnerability to second factor phishing attacks
Solution Approach 1:
The patent introduces a webview component as an intermediary between the browser and the authentication link. The webview embeds the browser within a controlled application environment, allowing the system to monitor and verify the authentication process while maintaining user-friendly browser-based access. This intermediary layer prevents phishing attacks by ensuring the authentication occurs within a trusted context.
Solution Approach 2:
The patent implements nesting by embedding the browser inside the application (webview contains browser). This nested structure allows the outer application layer to control and verify the inner browser's authentication activities, preventing external phishing sites from intercepting credentials while maintaining the convenience of browser-based authentication.
2Ease of operation
If traditional authentication methods are used to simplify login processes, then ease of operation is improved, but security is worsened due to password vulnerability to theft and impersonation
Solution Approach 1:
The webview acts as an intermediary that blocks direct access to traditional password-based authentication forms. It intercepts authentication requests and processes them through a secure channel, preventing credential theft while maintaining the simplicity of a single-click login experience for users.
Solution Approach 2:
The patent creates a secure copy of the authentication interface within the webview environment. Instead of using traditional password forms that can be intercepted, the system replicates the authentication process in a controlled, monitored environment that prevents credential harvesting while maintaining user convenience.
Data Source
AI summary
In one embodiment, a method, by an authentication server, includes generating a transaction identifier associated with an authentication request received from an external device. In response to verifying a first authentication factor of the authentication request, the method includes transmitting a prompt and the transaction identifier to the external device, wherein the prompt is an HTTP link associated with a browser comprising a generated cookie, the generated cookie being associated with the transaction identifier. The method includes receiving a signal comprising a transmitted transaction identifier and an instruction to process the HTTP link. The method includes instructing an application installed on the external device to open the browser in a webview in response to processing the instruction, wherein a cookie is provided. The method includes identifying the generated cookie based on verifying the transmitted transaction identifier. The method includes determining if the cookie is equivalent to the generated cookie.