User authentication techniques across applications on a user device
According to examples, a system for enabling user authentication may include a processor and a memory storing instructions. The processor, when executing the instructions, may cause the system to receive user login credentials and initiate a user authentication process by receiving a challenge configured using an attribute of a system including the processor. The processor executes further instructions to determine the attribute value and to derive a zero-knowledge proof in response to the challenge. The zero-knowledge proof is provided to the challenge issuer to access services of one or more applications.
1 . A system for providing content, comprising:
a processor; and
a memory storing instructions, which when executed by the processor, cause the processor to:
receive a first request from a user for a first content item on a content delivery network (CDN), wherein the first request includes a first universal resource locator (URL) to the first content item, the first URL comprising at least arguments for a first long expiry period, a first short expiry period, and a temporary user id;
determine whether the first short expiry period of the first URL is valid;
in response to determining that the first short expiry period of the first URL is invalid, determine whether the first long expiry period of the first URL is valid;
in response to determining that the first long expiry period of the first URL is valid, determine whether the user is authentic; and
in response to determining that the user is authentic, provide the user access to the first content item.
2 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
provide user credentials associated with at least one application to an application server;
receive an attribute-based challenge from the application server, wherein the attribute-based challenge includes a challenge generated using a verifier derived from the attribute;
determine a proof to the challenge using the attribute; and
access services of the application using a login token received from the application server in response to providing the proof.
3 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
receive user credentials associated with at least one application from a mobile device executing the at least one application;
generate an attribute-based challenge, wherein the attribute-based challenge includes a challenge generated using a verifier derived from an attribute of the mobile device;
receive proof from the mobile device in response to the challenge; and
enable access to services of the application in response to validating the proof.
4 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
register to use an application with an application server;
receive data regarding an attribute to be used for a login process;
derive a zero-knowledge verifier using a value of the attribute; and
provide the encrypted zero-knowledge verifier to the application server.
5 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
select an attribute of a mobile device executing at least one application to authenticate the user to access the at least one application;
transmit data regarding the selection of the attribute to the mobile device;
receive a zero-knowledge verifier from the mobile device, wherein the zero-knowledge verifier is based on the attribute of the mobile device; and
employ the zero-knowledge verifier in authenticating the user to access the at least one application.
6 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
receive an initial communication associated with a user session;
generate a data identifier including a dynamic element;
update the dynamic element to indicate an event associated with user is activity; and
implement criteria to determine whether an associated disparity may be actionable.
7 . The system of claim 6 , wherein the instructions when executed by the processor further cause the processor to at least one of: require a user action in response to the associated disparity, or receive an indication of the event associated with user activity.
8 . The system of claim 1 , wherein to execute the backend process the instructions further cause the processor to:
extract the temporary user id from the first URL; and
authenticate the user based on a comparison of the temporary user id with user data from a login session associated with the first URL.
9 . The system of claim 1 , wherein to determine whether the first long expiry period is valid, the instructions further cause the processor to:
determine validity of the first long expiry period based on the argument for the first long expiry period; or
determine validity of the first short expiry period based on the argument for the first long expiry period.
10 . The system of claim 1 , wherein the first content item is one of an image, a progressive video, or video on demand (VOD).
11 . A method for providing content to a user, the method being executed by one or more processors and comprising:
receiving a first request from a user for a first content item on a content delivery network (CDN), wherein the first request includes a first universal resource locator (URL) to the first content item, the first URL comprising at least arguments for a first long expiry period, a first short expiry period, and a temporary user id;
determining whether the first short expiry period of the first URL is valid;
in response to determining that the first short expiry period of the first URL is invalid,
determining whether the first long expiry period of the first URL is valid;
in response to determining that the first long expiry period of the first URL is valid, determining whether the user is authentic; and
in response to determining that the user is authentic, providing the user access to the first content item.
12 . The method of claim 11 , wherein the method further comprises:
providing user credentials associated with at least one application to an application server;
receiving an attribute-based challenge from the application server, wherein the attribute-based challenge includes a challenge generated using a verifier derived from the attribute;
determining a proof to the challenge using the attribute; and
accessing services of the application using a login token received from the application server in response to providing the proof.
13 . The method of claim 11 , wherein the method further comprises:
receiving an initial communication associated with a user session;
generating a data identifier including a dynamic element;
updating the dynamic element to indicate an event associated with user is activity; and
implementing criteria to determine whether an associated disparity may be actionable.
14 . A non-transitory computer-readable storage medium having an executable stored thereon, which when executed by a processor causes the processor to perform operations comprising:
receiving a first request from a user for a first content item on a content delivery network (CDN), wherein the first request includes a first universal resource locator (URL) to the first content item, the first URL comprising at least arguments for a first long expiry period, a first short expiry period, and a temporary user id;
determining whether the first short expiry period of the first URL is valid;
in response to determining that the first short expiry period of the first URL is invalid,
determining whether the first long expiry period of the first URL is valid;
in response to determining that the first long expiry period of the first URL is valid, determining whether the user is authentic; and
in response to determining that the user is authentic, providing the user access to the first content item.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein operations further comprise:
receiving an initial communication associated with a user session;
generating a data identifier including a dynamic element;
updating the dynamic element to indicate an event associated with user is activity; and
implementing criteria to determine whether an associated disparity may be actionable.
16 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
further in response to determining that the user is authentic, refreshing the first URL to provide a refreshed URL, wherein the user is provided access to the first content item using the refreshed URL.
17 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
receive a second request for a second content item on the CDN, wherein the second request includes a second URL to the second content item;
determine whether a second short expiry period of the second URL is valid; and
in response to determining that the second short expiry period of the second URL is valid, provide the user access to the second content item.
18 . The system of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
receive a second request for a second content item on the CDN, wherein the second request includes a second URL to the second content item;
determine whether a second short expiry period of the second URL is valid;
in response to determining that the second short expiry period of the second URL is invalid, determine whether a second long expiry period of the second URL is valid;
in response to determining that the second long expiry period of the second URL is invalid, prohibiting access to the second content item through the second URL.