Contactless Card Authentication System for Phishing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems for service providers are vulnerable to phishing and man-in-the-middle attacks, particularly during username/password exchanges, due to the reliance on static passwords and inadequate multi-factor authentication.
Innovation Solution
A method and system that utilize a contactless card cryptogram exchange for dual-factor authentication, where a client device retrieves a username and dynamic password from a contactless card, and these credentials are used to authenticate access requests to applications, enhancing security by providing unpredictable and dynamic authentication information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static passwords are used for authentication, then the authentication process is simple and fast, but the system becomes vulnerable to phishing and man-in-the-middle attacks
Solution Approach 1:
The patent transforms static passwords into dynamic passwords that change with each authentication attempt. The dynamic password is generated based on a seed value and a counter, ensuring that even if one password is compromised, it cannot be reused. This dynamic nature significantly enhances security against phishing and replay attacks while maintaining a relatively simple implementation through cryptographic functions.
Solution Approach 2:
The patent introduces a password generation device as an intermediary between the user and the authentication system. This device automatically generates dynamic passwords based on stored seed values and counter increments, eliminating the need for users to manually manage complex passwords. The intermediary handles the cryptographic operations and presents the dynamic password for authentication, simplifying the user interface while enhancing security.
2Reliability
If multi-factor authentication is implemented, then the security against malicious attacks is improved, but the authentication process time increases
Solution Approach 1:
The patent performs preliminary actions by pre-generating and storing multiple dynamic passwords in the password generation device before they are needed. The device maintains a pool of pre-computed passwords that can be quickly presented during authentication without requiring real-time cryptographic computation. This preliminary preparation significantly reduces authentication time while maintaining the security benefits of dynamic password generation.
Solution Approach 2:
The password generation device operates autonomously to generate and manage dynamic passwords without requiring continuous user intervention or complex server-side verification. The device self-manages the counter incrementation and password generation process, providing rapid authentication responses. This self-service capability reduces the time burden on users while implementing robust multi-factor authentication.
3Reliability
If dynamic passwords are generated and stored, then the unpredictability and security of credentials are enhanced, but the storage and management complexity increases
Solution Approach 1:
The patent implements a nested structure where the dynamic password is generated from a seed value through cryptographic functions. The seed value is stored securely in the password generation device, and the dynamic password is nested within the cryptographic transformation of this seed. This nesting approach allows secure storage of minimal data (the seed) while generating complex, unpredictable passwords on-demand, reducing storage complexity while maintaining high credential security.
Data Source
AI summary
A password-less authentication system and method include registering a contactless card of a client with an application service and binding the contactless card to one or more client devices. The contactless card advantageously stores a username and a dynamic password. Accesses by the client to the application service may be made using any client device, and authentication of the accesses may be performed by any client device that includes a contactless card interface and can retrieve the username and dynamic password pair from the contactless card. By storing the username on the card, rather than requiring user input, application security improved because access to and knowledge of login credentials is limited. In addition, the use of a dynamic password reduces the potential of malicious access.