User Registration With Conditional E-Mail Confirmation for Attack Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing user registration systems are vulnerable to false registrations when attackers use stolen e-mail addresses, leading to unauthorized access and service misuse.

Innovation Solution

An authentication system that includes an attack determination unit to identify potential attacks, requesting a confirmation operation from the e-mail address owner only when a registration request is suspected to be under attack, and allowing registration only if the confirmation confirms the request is legitimate.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If an identity verification e-mail with authentication link is transmitted to verify e-mail address validity, then the user registration process is simplified and automated, but the system becomes vulnerable to false registrations when attackers use stolen e-mail addresses

Engineering Contradiction:

Improveautomation of user registrationVSAvoidauthenticity of user registration

Core Design Contradiction:

Extent of automationVSReliability

Solution Approach 1:

The patent introduces an intermediary confirmation process between the automated authentication link and final registration. When an authentication request is received, the system checks whether the authentication request and registration request originate from the same terminal device. This intermediary verification step prevents attackers from using stolen e-mail addresses while maintaining automated registration for legitimate users.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback by comparing information from the authentication request (terminal device identifier) with information from the registration request. This feedback mechanism allows the system to detect and prevent false registrations caused by attackers while allowing legitimate automated registrations to proceed.

Inventive Principle:

Principle #23Feedback

2Reliability

If a confirmation operation is required from the e-mail address owner, then the risk of false registration is reduced, but the user registration process becomes more complex and time-consuming

Engineering Contradiction:

Improveauthenticity of user registrationVSAvoidcomplexity of registration process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies dynamics by making the confirmation process conditional rather than static. The system dynamically adjusts the registration process based on whether the authentication request and registration request originate from the same terminal device. Legitimate users experience a simple automated process, while suspicious cases trigger additional verification, optimizing both reliability and ease of use.

Inventive Principle:

Principle #15Dynamics

3Reliability

If the system verifies whether the authentication request and registration request are from the same terminal device, then false registrations are prevented, but the processing complexity and time increase

Engineering Contradiction:

Improveprevention of false registrationVSAvoidregistration processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary action by obtaining and storing the terminal device identifier when the authentication request is received, before the registration request is processed. This allows for rapid comparison and decision-making when the registration request arrives, preventing false registrations without adding significant processing time to legitimate registrations.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12432232B2Information processing apparatus, information processing method, and storage medium for processing registration requests

Publication Date: 2025.09.30 CANON KK

AI summary

When receiving a registration request for a user, an information processing apparatus transmits an e-mail including an authentication uniform resource locator (URL) to an e-mail address included in the registration request. The apparatus receives an authentication request for the e-mail address that is transmitted by access to the URL. The apparatus determines whether the registration request is under attack. If the registration request is determined to be under attack, the apparatus performs control to request a transmitter of the authentication request to perform an operation to confirm whether the transmitter has made the registration request. If the registration request is determined to be not under attack, the apparatus performs control not to request the confirmation operation. The apparatus then authenticates the e-mail address corresponding to the authentication request and registers the user. If the confirmation operation is requested, the apparatus does not register the user based on the confirmation operation.