Dynamic Personal Question Generation for Account Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user identification methods are insecure due to ease of obtaining security question answers by information-stealing tools, leading to reduced account security.
Innovation Solution
A system and process that dynamically generates and updates personal questions and corresponding standard responses based on account operating information, ensuring only the account owner can access and answer correctly, with mechanisms to anonymize responses on user devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security questions are stored on user devices for identification, then user identification can be performed, but information-stealing tools can easily obtain the answers, reducing account security
Solution Approach 1:
The system divides the security verification process into multiple independent components: personal questions are stored on the server, answers are encrypted and stored separately on the user device, and verification codes are generated dynamically during authentication. This segmentation prevents malware from obtaining complete security credentials, as each component alone is insufficient for unauthorized access.
Solution Approach 2:
The system performs preliminary encryption of security answers before storing them on the user device. The answers are encrypted using the user's public key or a derived key, so that even if malware accesses the stored data, it cannot decrypt the answers without the corresponding private key. This preliminary security measure prevents the harmful effect of information theft.
2Ease of operation
If personal questions and answers are stored on user devices, then user identification is enabled, but the answers can be guessed or discovered by information-stealing tools
Solution Approach 1:
The system introduces verification codes as an intermediary mechanism between the user's knowledge (personal questions/answers) and the authentication system. Instead of directly transmitting or storing plain-text answers, the system generates time-limited verification codes that serve as mediators. These codes are difficult to guess or discover, and they expire after use, preventing repeated attempts by information-stealing tools.
Solution Approach 2:
The system dynamically changes the parameter of verification codes by generating new codes for each authentication attempt and setting expiration times. This parameter change (from static answers to dynamic, time-limited codes) makes it extremely difficult for information-stealing tools to succeed, as the target keeps changing and eventually becomes invalid.
3Reliability
If security questions are used for user identification, then account access can be verified, but the current method is vulnerable to information-stealing tools
Solution Approach 1:
The system implements self-service encryption where the user's own cryptographic keys (public and private key pairs) are used to encrypt and decrypt security answers. The user device itself performs the encryption/decryption operations without requiring additional third-party security modules or complex hardware. This self-service approach enhances security while minimizing the increase in system complexity.
Data Source
AI summary
Identifying users is disclosed including, in response to receiving an account operating request of an account sent by a user device, obtaining a personal question from a personal questions database and sending the personal question to the user device, receiving, from the user device, a verification response to the personal question, and determining whether a current user is a user associated with the account based at least in part on the verification response and a corresponding standard response in the personal questions database, where the personal question obtained from the personal questions database and the corresponding standard response were generated based at least in part on account operating information of the user associated with the account.