User Authentication via Pre-Captured Reference Images
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods, particularly in distributed networks, are vulnerable to man-in-the-middle attacks and phishing scams, as security images provided by servers can be ineffective in ensuring legitimate connections, leading to potential theft of login credentials.
Innovation Solution
A method where a user-supplied image is associated with login credentials and compared to an uploaded image from a multifunction device, allowing authentication only if they match exactly, incorporating additional login credentials and a unique image, IMEI, and phone number for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If server-provided security images (site keys) are used for authentication, then users can verify legitimate servers, but the security is ineffective against man-in-the-middle attacks where SSL is removed or imposter pages claim image systems are down
Solution Approach 1:
The user's client device captures a reference image from the server during a trusted connection (when SSL is verified) and stores it locally before any potential attacks occur. This pre-captured image serves as a genuine reference that cannot be manipulated by later phishing attempts or man-in-the-middle attacks, as it was obtained when the connection was already verified secure.
Solution Approach 2:
Instead of the server providing security images that users must trust, the inversion approach has the user's device capture and store the genuine server image locally, then use that locally-stored image as the authority for verification. This shifts trust from the server's current state to the user's previously verified state, making phishing and MITM attacks ineffective.
2Reliability
If multiple authentication factors (image, IMEI, phone number, login credentials) are required, then security is enhanced, but the authentication process becomes more complex
Solution Approach 1:
Multiple authentication factors (device image, IMEI, phone number, login credentials) are merged into a single comprehensive authentication process. The system combines these elements so that they work together as an integrated security mechanism, where the device image serves as a visual confirmation that ties the physical device to the account, while IMEI and phone number provide device-specific verification.
Solution Approach 2:
The user's client device autonomously captures and stores its own reference image and device identifiers (IMEI, phone number) without requiring manual configuration or complex setup procedures. The device self-configures the authentication parameters, reducing the complexity burden on the user while maintaining strong security.
Data Source
AI summary
A method of authenticating a user of a multifunction device to a server, the method comprising associating a user-supplied image with user login credentials, using a server; receiving, at the server, an image uploaded from the multifunction device; and comparing the uploaded image to the user-supplied image, using the server, and, only if the uploaded image matches the user-supplied image, allowing the user of the multifunction device to authenticate to the server by providing additional login credentials to the server using the multifunction device.