Extensionless Phish-Proof MFA with Browser and Site Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor authentication (MFA) solutions are vulnerable to phishing attacks and require browser extensions or hardware components like USB authenticators, which can be bypassed by attackers using social engineering techniques.
Innovation Solution
A browser extensionless MFA method that uses a mobile device and browser API to verify the authenticity of the visited site through iframe postMessage or ORIGIN header checks, eliminating the need for physical security keys or browser extensions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional MFA solutions are used, then authentication security is improved, but vulnerability to phishing attacks increases
Solution Approach 1:
The patent introduces a browser extension as an intermediary component that sits between the user's browser and the MFA service. This extension intercepts FIDO requests, verifies the authenticity of the requesting site using public key infrastructure, and only relays legitimate requests to the mobile device for MFA attestation generation. This intermediary layer prevents phishing sites from directly obtaining MFA attestations while maintaining the security benefits of traditional MFA.
2Reliability
If hardware components like USB authenticators are used, then phish-proof authentication is achieved, but device complexity increases
Solution Approach 1:
The patent creates a virtual copy of the hardware authenticator functionality by implementing a browser extension that emulates USB authenticator behavior. Instead of requiring physical security keys, the extension uses software-based cryptographic operations within the browser environment to generate and verify MFA attestations, providing equivalent security without the physical hardware component.
3Reliability
If browser extensions are required for MFA, then phish-proof protection is enabled, but ease of operation decreases
Solution Approach 1:
The browser extension performs self-service by automatically handling the complex cryptographic operations, site authentication verification, and MFA attestation relay without requiring user intervention. The extension manages its own key pairs, verifies the authenticity of requesting sites using stored public keys, and seamlessly integrates with the mobile device's MFA service, providing phish-proof protection while maintaining ease of use.
Data Source
AI summary
A multi-factor authentication scheme uses an MFA authentication service and a browser extensionless phish-proof method to facilitate an MFA workflow. Phish-proof MFA verifies that the browser the user is in front of is actually visiting the authentic (real) site and not a phished site. This achieved by only allowing MFA to be initiated from a user trusted browser by verifying its authenticity through a signing operation using a key only it possesses, and then also verifying that the verified browser is visiting the authentic site. In a preferred embodiment, this latter check is carried out using an iframe postMessage owning domain check. In a variant embodiment, the browser is verified to be visiting the authentic site through an origin header check. By using the iframe-based or ORIGIN header-based check, the solution does not require a physical security key (such as a USB authenticator) or any browser extension or plug-in.