Dynamic Keypad Authentication System for Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to keystroke loggers and shoulder surfing, as users enter PINs or passwords directly, which can be intercepted or observed, leading to unauthorized access.
Innovation Solution
A method and system that generates a one-time verification code by combining a user access code with a random or pseudo-random string, displaying cells with integers that correspond to the access code, allowing users to select integers to generate a transaction code that matches the verification code, thereby ensuring secure identity verification without direct input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a user enters a PIN or password directly using keystrokes, then the authentication process is simple and fast, but the system becomes vulnerable to keystroke loggers and malware that can intercept the input
Solution Approach 1:
The patent introduces a virtual keypad interface as an intermediary between the user's physical input device and the authentication system. The user interacts with visual key representations on the screen, and the system maps these selections to the actual PIN digits. This intermediary layer prevents direct keystroke capture while maintaining the authentication function.
Solution Approach 2:
The patent replaces the traditional mechanical keyboard input system with a graphical user interface-based selection system. Instead of physical key presses that can be logged, the user clicks or touches visual representations of keys on the screen, substituting mechanical input with graphical interaction that is harder to intercept.
2Ease of operation
If a fixed virtual keypad layout is used to prevent shoulder surfing, then the interface is easy to use, but sophisticated malware can detect pointer position and deduce the data being entered
Solution Approach 1:
The patent implements a dynamic virtual keypad where the position, size, and arrangement of key representations change between authentication attempts. This dynamic reconfiguration prevents malware that tracks pointer positions from reliably mapping screen coordinates to specific PIN digits, as the mapping changes each time the interface is presented.
Solution Approach 2:
The system performs preliminary randomization of the keypad layout before the user begins entering their PIN. By pre-shuffling the key positions and notifying the user of the current layout, the system establishes a unpredictable mapping that prevents malware from anticipating which screen location corresponds to which digit.
3Object-affected harmful factors
If the keypad layout changes dynamically to prevent malware detection, then security is improved, but the user interface becomes more complex and harder to use
Solution Approach 1:
The patent applies local quality by providing contextual guidance specifically at the moment of key selection. Visual indicators highlight which key should be selected next, and the interface maintains familiar keyboard-like patterns that users can recognize. This localized assistance reduces the cognitive load despite the overall dynamic nature of the interface.
Solution Approach 2:
The virtual keypad is designed to work with multiple input methods (mouse clicks, touch screen selections, keyboard navigation) while maintaining a consistent visual interface. This multi-functionality allows users to interact with the dynamic keypad using their preferred method, reducing the perceived complexity while maintaining security.
Data Source
Figure 1~2
Figure 3
AI summary
There is disclosed a method and system for verifying an identity of a user to a computer system. The user is assigned a user access code in the form of an invariant string of integers from 0 to 9, with length no greater than ten. The user access code is stored in the computer system;the computer system generates a ten-digit random or pseudo-random non-repeating string of the integers 0 to 9, the string having 1st to 10th positions each with a unique integer and having respective positional values 1 to 10;and the computer system performs a predetermined algorithm to combine the user access code and the random or pseudo-random string, thereby to determine a one-time verification code in the form of a string of the same length as the user access code. The computer system also generates 1st to 10th cells, the cells having respective locational values 1 to 10; populates the cells with the integers of the non-repeating string such that the locational value of each cell corresponds to the integer it contains combined with the random or pseudo-random string using the same predetermined algorithm as used previously; and displays the cells on a display. A user uses an input device of the computer system to select, in order, the cells on the display that contain the integers constituting the user access code. Each act of selection returns the locational value of the selected cell, thereby to generate a one-time transaction code comprising a string of integers from 0 to 9 having the same length as the user access code. The computer system then compares the verification code with the one-time transaction code and makes a successful identity verification if the verification code matches the one-time transaction code.