Identity Verification Device Preventing Account Enumeration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password reset mechanisms are vulnerable to attacks, allowing hackers to reset user passwords even if they fail to crack the original password, compromising system security and user experience.
Innovation Solution
A method that involves the verifier sending consistent confirmation information for both valid and invalid accounts, preventing hackers from determining account validity and reducing the risk of password reset vulnerabilities, while allowing users to identify incorrect accounts and improve user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the verifier returns different confirmation information for valid and invalid accounts, then users can identify incorrect accounts, but hackers can enumerate valid accounts using the confirmation information
Solution Approach 1:
The patent applies local quality by making the confirmation information form consistent (to prevent enumeration) while allowing local differentiation through binding information content (to enable user identification). The form homogeneity masks account validity, but the binding information embedded within can still help users verify if they own the account through selective information matching.
Solution Approach 2:
The patent uses homogeneity by making the confirmation information form identical for both valid and invalid accounts. This prevents hackers from determining account validity by analyzing differences in confirmation information structure, while users can still identify incorrect accounts by checking if the binding information within matches their known account details.
2Reliability
If the verifier generates binding information for invalid accounts, then the confirmation information form remains consistent, but system resources are consumed generating fake information
Solution Approach 1:
The patent applies copying by creating a fake confirmation information structure that mirrors the valid account format. Instead of generating entirely new fake binding information, the system copies the form structure and populates it with generated or placeholder binding information, reducing computational overhead while maintaining form consistency.
3Ease of operation
If the verifier sends verification information to invalid accounts, then the user experience is improved with consistent responses, but network congestion increases
Solution Approach 1:
The patent extracts the essential function of providing consistent confirmation information while removing the harmful effect of sending actual verification information to invalid accounts. The system sends confirmation information with binding data for display purposes but excludes the actual verification codes or sensitive authentication data that would cause network congestion and security risks.
Data Source
AI summary
An identity verification method and a verifying device, where the verifying device receives an account for requesting password reset. When the account is invalid, the verifying device sends a fake identification and a first verification request to a requesting device. The verification request mentioned requests a user to determine whether to send verification information to a first communication address. The fake identification and the first communication address are associated with the first account.