Dynamic Session Credential Generation to Defeat Keystroke Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Keystroke logging attacks compromise user identification information by secretly recording and transmitting credentials, posing a significant threat to security, especially in accessing financial accounts.
Innovation Solution
A system generates unique, session-specific pseudonyms and passwords by randomly replacing characters in usernames and passwords, using a key substitution table displayed as an image file, with all processing occurring on the server side to prevent unauthorized access and keylogging attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static usernames and passwords are used for login, then ease of operation is improved, but security is worsened due to keystroke logging attacks
Solution Approach 1:
The patent transforms static login credentials into dynamic, session-specific credentials. Each login session generates a unique password through random character substitution based on the user's username and a randomly selected substitution table, making credentials changeable and adaptive rather than fixed and predictable
Solution Approach 2:
The system changes the parameters of login credentials by substituting specific characters in the username with random characters from substitution tables. This transforms the static password into a dynamically generated credential that varies each session while maintaining a relationship to the user's chosen username
2Reliability
If session-specific passwords are generated by random character substitution, then security is improved, but device complexity is worsened
Solution Approach 1:
The system uses the user's own username as the basis for generating their session-specific password. The username automatically serves as the seed for the substitution process, eliminating the need for separate password management and reducing overall system complexity
Solution Approach 2:
Substitution tables are pre-generated and stored in the system before login attempts. These tables contain predetermined character mappings that can be randomly selected during login, avoiding the need to generate complex substitution logic in real-time and reducing computational complexity
3Reliability
If key substitution tables are displayed as image files, then protection against keylogging is improved, but ease of operation is worsened
Solution Approach 1:
The substitution table is presented as an image file that serves as an intermediary between the system and the user. The image displays the character mappings visually, allowing users to reference it while typing their session-specific password, thus maintaining ease of use while preventing direct access to the actual substitution data
Data Source
AI summary
Static security credentials are replaced by pseudonyms and session-specific passwords to increase security associated with user login attempts, and specifically to defeat keylogging attacks. For each login event, the system generates unique, session-specific credentials by randomly replacing characters within a given username and password. The random character generation ensures that system login attempts use different combinations of characters, thereby producing a new username and password for every user session. The client side of the system requires only the capability to display an image file, with specialized software/hardware limited to the server side, thereby facilitating the use of the system by a wide range of client devices.