Dynamic Password Verification via Intermediary Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic password methods, while enhancing security, fail to prevent attacks from phishing websites and risk user information and property loss due to the potential theft of dynamic passwords.
Innovation Solution
A verification method and system that involves a server-side and user-side interaction, where a dynamic password is generated and split into components, with the server verifying the password and sending authentication tokens to the user, ensuring legitimate identity confirmation and preventing phishing attacks by encrypting transaction information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic password method is used to enhance security, then password security is improved, but the system becomes vulnerable to phishing attacks and password theft
Solution Approach 1:
The patent introduces a verification code as an intermediary element between the user and the password authentication system. The verification code is generated by the server and sent to the user, who then uses it to authenticate transactions. This intermediary mechanism prevents phishing attacks by ensuring that even if a user inputs their password on a fake website, the authentication will fail because the verification code can only be obtained through the legitimate banking channel.
Solution Approach 2:
The server performs preliminary actions by generating and sending verification codes before the actual transaction occurs. The verification code is prepared in advance and must be presented during the transaction authentication process. This preliminary action ensures that the user has been properly verified and that the transaction is authorized before any money transfer or account change takes place.
2Reliability
If dynamic password is generated and verified, then authentication security is enhanced, but the complexity of the verification process increases
Solution Approach 1:
The authentication process is segmented into distinct stages: first, the user inputs their password; second, the server generates and sends a verification code; third, the user presents the verification code during transaction authentication. This segmentation divides the complex authentication process into manageable steps, making it easier to implement and understand while maintaining high security.
Solution Approach 2:
The system implements feedback mechanisms where the server sends verification codes to the user based on their login status and transaction requests. The verification code serves as feedback that confirms the user's identity and authorizes the transaction. This feedback approach simplifies the verification process by providing clear, actionable information to the user without requiring complex authentication procedures.
Data Source
AI summary
The invention discloses an authenticating method and a system thereof, which relates to information security field and solves the problem that the user information is not safe in transaction process. The embodiment of the invention comprises that the server side receives user data information and a first dynamic password sent from the user side; the server side generates the first authenticating dynamic password according to the user data information; server side verifies the first dynamic password according to the first authenticating dynamic password and generates the second authenticating dynamic password after successful verification; the server side sends the second authenticating dynamic or the first password to the user side; the server side executes the transaction data in the user data information or permits the user to log on after using a third authenticating dynamic password generated by the server side to verify the user data information or the third dynamic password sent from the user side successfully. The invention enhances the safety of transaction for the user and prevents the user from loss caused by logging on phishing website by the user.