Account Hijacking Counter-Measures via Device Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User accounts are vulnerable to hijacking due to the lack of additional authentication measures beyond traditional username and password verification, allowing unauthorized access and potential data manipulation.
Innovation Solution
Implementing a second layer of authentication that utilizes device identifiers and security questions based on user account information, such as contact names, calendar events, and email content, to verify user identity before granting access to the account.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional username and password verification is used, then ease of operation is improved, but account security deteriorates
Solution Approach 1:
The authentication process is segmented into multiple independent stages: first credential verification (username/password), second device identification (IP address/device fingerprint), and third security question validation. Each stage acts as a separate security layer that must be passed to grant access, resolving the contradiction by maintaining ease of operation through automated multi-factor authentication while significantly improving account security through layered verification
Solution Approach 2:
The authentication system transitions from single-dimensional credential verification to multi-dimensional authentication by incorporating device identifiers (IP address, device fingerprint) and security questions as additional authentication dimensions. This dimensional expansion allows the system to maintain user convenience while adding security layers that traditional single-factor authentication cannot provide
2Reliability
If additional authentication layers are added, then account security is improved, but device complexity increases
Solution Approach 1:
The system performs self-service authentication by automatically detecting device identifiers (IP address, device fingerprint) and selecting security questions without requiring user intervention. The authentication process is handled autonomously by the system, which manages the complexity of multiple verification layers while presenting a simple interface to the user, thus improving security without significantly increasing perceived user complexity
Solution Approach 2:
The authentication system dynamically changes parameters such as security question selection and device identifier validation based on risk assessment. The system adjusts authentication requirements based on factors like login location, device reputation, and account history, allowing flexible security adaptation that maintains simplicity while improving protection against attacks
3Reliability
If security questions based on account information are used, then account security is improved, but difficulty of detecting and measuring increases
Solution Approach 1:
The system implements feedback mechanisms where the user's answers to security questions are verified against stored account information, and the results feed back into the authentication decision. This feedback loop allows the system to confirm user identity through personal knowledge while maintaining automated verification processes that simplify the measurement and detection of authentication success
Data Source
AI summary
A method for providing an additional layer of authentication prior to accessing a user's account even though the user's credentials have previously been verified. User accounts are often accessed via a sign-in page that verifies the user's credentials. Upon detecting a device accessing the sign-in page, an identifier associated with the device is obtained. One such type of identifier is the IP address assigned to the device. Based on the identifier, it is determined whether the device is trusted or not. Even thought the user's credentials are verified via the sign-in page, if the device is not trusted, a second authentication page is presented to the user prior to proceeding to the account. The second authentication page presents at least one security question. The security question is based on information contained in the user's account (e.g., contact information, event information, electronic messages, etc.). The user is required to correctly answer the security question in order to access the account.