Phishing attack prevention for OAuth applications
AssigneeInternational Business Machines Corporation
InventorsJiande Jiang, Sheng Hao Wang, Chih-Hung Chou, Kuo-Chun Chen
Life of this patent
Estimating the term…
Abstract
An example operation may include one or more of obtaining a request to validate an application with respect to an OAuth provider, identifying a previously registered digital signature of the application, generating verification information of the application based on the identified digital signature of the application, and passing the generated verification information of the application to the OAuth provider via a user login page.
Claims20
A computing system comprising:
- a network interface;
- and
- a processor configured to obtain a request to validate an application with respect to an OAuth provider, identify a previously registered digital signature of the application, and generate verification information of the application based on the identified digital signature of the application,
- wherein the processor is further configured to:
- control the network interface to pass the generated verification information of the application to the OAuth provider via a user login page and generate a unique application-based one-time password based on a shared secret with the OAuth provider and the application signature.
A method comprising:
- obtaining a request to validate an application with respect to an OAuth provider;
- identifying a previously registered digital signature of the application;
- generating verification information of the application based on the identified digital signature of the application;
- and
- passing the generated verification information of the application to the OAuth provider via a user login page;
- wherein a unique application-based one-time password is generated based on a shared secret with the OAuth provider and the application signature.
A non-transitory computer readable medium comprising instructions, that when read by a processor, cause the processor to perform a method comprising:
- obtaining a request to validate an application with respect to an OAuth provider;
- identifying a previously registered digital signature of the application;
- generating verification information of the application based on the identified digital signature of the application;
- and
- passing the generated verification information of the application to the OAuth provider via a user login page;
- wherein a unique application-based one-time password is generated based on a shared secret with the OAuth provider and the application signature.
Dependencies are inferred from the claim text.