Authentication System Using Intermediary Server for MitD Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication and authorization systems face challenges in securing access to resources, particularly at level 4 threats where attackers intercept and modify communication, leading to session hijacking and Man-in-the-Device (MitD) attacks, with existing solutions being costly, complex, and difficult to deploy and use effectively.
Innovation Solution
A computer-implemented method using a second server with a dedicated program on a user's device for enhanced authentication, involving credential exchange, mutual authentication, and an extra authentication factor mechanism using public/private key encryption or digital signatures to secure access and verify user operations, allowing users to manage account locking policies and delegate control securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing authentication/authorization schemes are adopted to protect against level 4 threats, then security is improved, but cost and complexity increase significantly
Solution Approach 1:
The patent introduces a second server as an intermediary component that mediates between the first server and the user device. This second server handles the complex authentication factor verification and status checking, allowing the first server to maintain simple authorization logic while still achieving enhanced security against level 4 threats through the coordinated interaction with the intermediary second server
2Reliability
If existing authentication/authorization schemes are adopted to protect against level 4 threats, then security is improved, but ease of deployment deteriorates
Solution Approach 1:
The patent segments the authentication/authorization system into distinct functional components: a first server for authorization logic, a second server for authentication factor management, and a user device with dedicated program. This segmentation allows each component to be developed, deployed, and maintained independently, improving ease of deployment while achieving enhanced security through their coordinated interaction
3Device complexity
If traditional authentication mechanisms are used, then implementation is simpler, but protection against session hijacking and MitD attacks is insufficient
Solution Approach 1:
The patent implements preliminary action by requiring the user device to proactively check its status with the second server before executing operations, and by pre-establishing authentication factors through the dedicated program. This preliminary verification ensures that even if session hijacking or MitD attacks occur during operation, the system has already established secure authentication boundaries that prevent unauthorized access
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer implemented method and computer program products to improve security in authentication/authorization systems. The computer implemented method comprising controlling the access to different resources and actions defined for a user by a first server, reducing the exposure time at which such operations are available, establishing a dual channel verification through the use of a second server and a defining a secure channel for certificate exchange for authentication. The computer programs implement the method.