Device independent authentication system and method

What is this patent about?

’363 is related to the field of wireless internet communications and secure session management. Specifically, it addresses the technical challenge of maintaining persistent, authenticated user sessions on mobile devices that lack the memory or software support for traditional browser cookies. The context involves the transition from standard PC-based web browsing to early mobile web environments where hardware constraints often broke the standard mechanisms used for security and session tracking.

The underlying idea behind ’363 is to bypass the need for cookie files by embedding session-specific security data directly into the markup of the web page itself. Instead of relying on the browser to manage a separate text file, the system utilizes HTML-INPUT tags—specifically hidden fields—to carry an encrypted security token. This approach effectively turns the stateless HTTP protocol into a stateful session by forcing the communication device to reflect the token back to the server within the body of subsequent requests, ensuring the server can verify the user's identity without local file storage.

The claims of ’363 focus on a multi-stage authentication method that validates both the user and the specific hardware being used. The process begins by inspecting an incoming HTTP request for client agent data and device model information to determine if the hardware is authorized to access the service. If the device is permitted but lacks a valid session, the server issues a security token encapsulated within an HTML tag after a successful login, which the communication device then stores in its temporary memory for the duration of the session.

In practice, the invention functions as a gatekeeper that first filters traffic based on the device's identity—such as the service provider or the specific phone model—before even attempting user-level authentication. Once a device is cleared, the server dynamically generates a hidden input field containing a 128-bit encrypted token. Because this token is part of the HTML form data or request body, it bypasses the memory limitations that typically cause wireless devices to reject or truncate large cookie files, allowing for secure 'clickthrough' navigation across multiple pages.

This solution differentiates itself from prior approaches like URL rewriting or proxy-based mapping by avoiding the character limits and security risks associated with long, visible query strings. Unlike URL rewriting, which can exceed the 100-character capacity of early mobile browsers, the use of hidden HTML tags keeps the session data internal to the request processing. Furthermore, by performing a hardware-level check against a database of authorized models and agents, the system adds a layer of device-specific validation that prevents unauthorized hardware from even reaching the login interface.