Anti-Phishing Authentication via Commitment Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures, such as one-time passwords (OTPs), do not adequately protect against phishing attacks, particularly in man-in-the-middle scenarios where attackers can intercept and exploit session information, leading to potential financial and identity-related losses.
Innovation Solution
Implementing a multi-factor authentication system where the client does not reveal the static credential until authenticating the server, using a sequence of OTPs that appear random and are generated using a secret key, ensuring that both the client and server authenticate each other through a commitment key and encrypted values, thereby protecting against phishing attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a One-Time Password (OTP) is used for authentication, then the difficulty of replay attacks is increased, but the system remains vulnerable to man-in-the-middle attacks where attackers can intercept and relay sessions
Solution Approach 1:
The client performs server authentication before sending the static credential. The system establishes a verified communication channel with the legitimate server through OTP validation and commitment key exchange prior to transmitting sensitive authentication data, preventing attackers from intercepting credentials in unverified sessions
Solution Approach 2:
A commitment key mechanism serves as an intermediary that binds the OTP validation to the specific server identity. The commitment key, derived from the OTP and server identifier, acts as a mediator that ensures the OTP was validated with the legitimate server rather than an attacker, breaking the man-in-the-middle attack chain
2Ease of operation
If the client sends static credential early in the authentication process, then the authentication flow is simplified, but the client exposes sensitive information to potential attackers
Solution Approach 1:
The system performs preliminary server verification through OTP validation and commitment key exchange before the client transmits the static credential. This preliminary authentication sequence ensures the communication channel is secure before exposing sensitive credentials, reversing the traditional order to prioritize security
Solution Approach 2:
The system implements preliminary anti-action by validating the server's identity and establishing a secure channel through OTP and commitment key mechanisms before allowing any credential transmission. This preemptive security measure counteracts potential credential theft by ensuring credentials only travel over verified secure channels
Data Source
AI summary
A method and system for providing security against phishing attacks. The method can include receiving a login ID from a client, and providing an encrypted commitment to the client. The method can also include receiving a one-time password (OTP) from the client, and validating the OTP. The method can also include sending a commitment key, to be authenticated by the client, receiving a static password from the client and authenticating the client. Embodiments of the invention are directed to a system for providing security against phishing attacks. The system can include one or more servers configured to receive a login ID from a client, and provide an encrypted commitment to the client. The processors can be configured to receive a one-time password (OTP) from the client, validate the OTP, send a commitment key, to be authenticated by the client, receive a static password from the client and authenticate the client.