Two-Factor Authentication Using Graphical Session Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to man-in-the-middle attacks, as they require users to enter both their identification and password simultaneously, allowing attackers to obtain both credentials.
Innovation Solution
A method that separates the identification from the password by using a unique session code and a graphical code, such as a QR code, to authenticate users. The user identification is entered at a device, and a unique session code is created at an authentication server. This session code is displayed as a graphical code on the device, which is scanned by a mobile device to capture the code. The session code and password are then sent to the authentication server for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users enter both identification and password simultaneously in known authentication systems, then the authentication process is simple and quick, but the system becomes vulnerable to man-in-the-middle attacks where attackers can obtain both credentials
Solution Approach 1:
The authentication process is segmented into distinct phases: first the user enters identification to obtain a session code, then separately enters the password. This segmentation prevents simultaneous transmission of both credentials, addressing the security vulnerability while maintaining reasonable process complexity through clear step-by-step guidance.
Solution Approach 2:
The system performs preliminary action by generating and displaying a unique session code after identification entry but before password entry. This intermediate step creates a time-separated authentication flow where the session code serves as a bridge, ensuring credentials are not captured simultaneously by potential attackers.
2Reliability
If a unique session code is created and displayed as a graphical code to separate identification entry from password entry, then security against man-in-the-middle attacks is improved, but the authentication process time increases
Solution Approach 1:
The system replaces traditional text-based credential entry with graphical code display and mobile device scanning. The unique session code is presented as a graphical representation that users scan with their mobile devices, automating the code capture process and reducing manual input time despite the additional security step.
Solution Approach 2:
The session code is created as a graphical copy (visual representation) that can be rapidly scanned and captured by mobile devices. This copying mechanism allows the session code to be transmitted efficiently without requiring manual typing, minimizing the time penalty associated with the enhanced security protocol.
3Reliability
If a graphical code is displayed and scanned using a mobile device to capture the session code, then the separation of identification and password is enhanced, but the device complexity increases
Solution Approach 1:
The system leverages the mobile device's existing camera and scanning capabilities, making the authentication process compatible with standard smartphones without requiring specialized hardware. This universal approach allows any mobile device to participate in the enhanced security protocol, reducing overall system complexity despite the added security features.
Solution Approach 2:
The mobile device serves as an intermediary between the authentication system and the user, handling the graphical code scanning and session code capture. This intermediary role simplifies the authentication server's workload and provides a user-friendly interface, distributing system complexity across multiple components rather than concentrating it in one location.
Data Source
AI summary
Methods for providing two-factor authentication having identification-obfuscated authentication flow prevents the sending and receiving of a user identification along with a password. An authentication server receives the user identification and generates a graphical code having a unique session code or a PIN code. The unique session code or the PIN code are stored at the authentication server with the user identification. The appropriate code is sent to the device. The device captures the graphical code or the PIN code. The captured code is sent with the password for the user account to the authentication server. The authentication server authenticates that the user identification based on the password is associated with the session code or the PIN code.