Dynamic Cryptographic Code Authentication Against Phishing Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity security and fraud prevention technologies, such as passwords and two-factor authentication, are inadequate in protecting against phishing, session hijacking, and man-in-the-middle attacks, particularly in online transactions, as static codes like CVV are easily compromised.
Innovation Solution
Implementing a dynamic cryptographic code system where a user-specific dynamic key is used to generate a temporary code through a cryptographic algorithm, integrated with an identity management system, ensuring secure authentication by synchronizing with an access control server to authorize operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static codes like CVV are used for authentication, then ease of operation is improved, but security is worsened as they are easily compromised in phishing and database breaches
Solution Approach 1:
The patent transforms static authentication codes into dynamic codes that change over time. The authentication code is generated dynamically based on a secret value and current time, ensuring that even if one code is compromised, it cannot be reused. This resolves the contradiction by maintaining ease of operation (users still enter a code) while dramatically improving security (codes are no longer static and reusable).
Solution Approach 2:
The patent changes the parameter of the authentication code from static to time-dependent. By introducing time as a variable parameter in the code generation process, the system ensures that authentication codes expire after a short period, preventing replay attacks and database breach exploitation while maintaining user-friendly authentication flow.
2Reliability
If dynamic cryptographic codes are implemented, then security is improved by preventing attacks, but device complexity is worsened due to cryptographic algorithm requirements
Solution Approach 1:
The patent extracts the complex cryptographic operations from the merchant server and places them in the payment terminal or user device. The merchant server only needs to verify signatures and validate time windows, while the heavy cryptographic lifting (key generation, signature creation) occurs locally where security is more easily managed. This reduces the complexity burden on the merchant system while maintaining strong security.
Solution Approach 2:
The patent introduces a payment terminal as an intermediary between the user and the merchant server. This intermediary handles the complex cryptographic operations, key management, and authentication logic, shielding the merchant server from complexity while ensuring secure authentication. The terminal acts as a dedicated security device that simplifies the overall system architecture.
3Reliability
If dynamic codes with time windows are used, then security is improved against replay attacks, but loss of time is worsened due to code expiration validation
Solution Approach 1:
The patent implements a time window approach where codes are valid for a short period (e.g., 5 minutes) rather than requiring real-time validation. This partial action approach balances security (codes expire to prevent replay attacks) with usability (users have enough time to complete transactions without immediate expiration). The validation only checks if the current time falls within the acceptable window, not requiring continuous real-time synchronization.
Data Source
AI summary
Systems and methods of the present disclosure enable operation authorization using a dynamic code. Embodiments includes a computing system for receiving, from an access control server, an operation authorization request to authorize an operation by an initiator, where the operation authorization request includes a user identifier associated with the operation authorization request, and a dynamic code. The computing system accesses a dynamic key associated with a user credential associated with the user identifier and generates a recalculated dynamic code using a cryptographic algorithm and the dynamic key. The computing system authenticates the operation authorization request based on the dynamic code being equivalent to the recalculated dynamic code and returns the authentication to the access control server to authorize the operation.