AI Authentication System Preventing Social Engineering via Natural Language Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing use of mobile devices for various actions poses a challenge in preventing social engineering attacks, particularly those involving one-time passwords (OTPs), where users may be tricked into providing OTPs to malicious actors.
Innovation Solution
A user authentication system that generates natural language representations of user actions based on parameters and prompts users to describe their actions, using a machine learning model to match user responses with the generated representations, thereby authenticating or canceling actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTPs are sent via SMS for authentication, then user authentication is enabled, but users become vulnerable to social engineering attacks where malicious actors can trick users into providing OTPs
Solution Approach 1:
The system sends a feedback message to the user asking them to describe the action they are attempting to perform. This feedback mechanism allows the user to verify whether the authentication request is legitimate before providing the OTP, thereby preventing social engineering attacks while maintaining authentication functionality
Solution Approach 2:
The system introduces an intermediary verification step between the authentication request and the OTP provisioning. The user must confirm the action details through natural language description, serving as a mediator that prevents direct manipulation by malicious actors
2Object-affected harmful factors
If users are prompted to describe their actions in natural language, then social engineering attacks are prevented, but the authentication process becomes more complex and time-consuming
Solution Approach 1:
The system leverages the user's own natural language description of their intended action as the verification mechanism. Rather than requiring complex security questions or additional authentication steps, the user simply describes what they are doing, making the process simpler despite the added verification layer
Solution Approach 2:
The system changes the verification parameter from traditional OTP entry to natural language action description. This parameter change allows the system to understand user intent through language processing, simplifying the user experience while maintaining security against social engineering attacks
3Measurement precision
If the system processes natural language responses to verify user actions, then authentication accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system processes only the essential natural language description provided by the user rather than requiring comprehensive verification. By focusing on the key action description, the system achieves sufficient accuracy for verification while minimizing processing time and computational resource consumption
Data Source
AI summary
Methods and systems are described herein for authenticating user actions, while preventing social engineering attacks on the user. A request may be received for performing an action. The system may obtain, based on a plurality of parameters, a plurality of natural language representations of the action and prompt the user, on the user's mobile device, to describe what the user is attempting to do. The system may then use a machine learning model to determine whether the requested action matches the user's response. Based on determining that the natural language response matches a natural language representation, the system may generate a communication indicating that the action has been authenticated.