Image Relation Rule Authentication Against Man-In-Browser Attacks

The patent introduces an intermediary image-based authentication mechanism between the user and the authentication system. Instead of directly using OTPs that can be intercepted, the system uses images displayed on the user's device screen as a mediator. The malicious application cannot easily capture or intercept these images without detection, as they are rendered through the device's display system rather than being transmitted as readable text or data through communication channels.

The patent replaces the mechanical/text-based OTP transmission system with a visual/image-based authentication system. The authentication challenge and response are conveyed through images displayed on the device screen rather than through SMS messages or text-based communication. This substitution makes it difficult for MIB applications to intercept and manipulate the authentication data, as they would need to manipulate the display rendering itself rather than intercepting communication protocols.

The patent makes the user's existing device serve multiple functions: it acts as both the authentication challenge recipient (displaying the first image) and the authentication response sender (capturing and transmitting the second image). The device's existing components (display screen, camera, communication modules) are utilized for authentication purposes without requiring separate dedicated authentication hardware, thereby reducing overall system complexity while maintaining security.

The authentication system leverages the user's own device resources and capabilities to perform authentication functions. The device itself generates or receives the authentication challenge, displays it, captures the user's response through its camera or input mechanisms, and transmits the verification data. This self-service approach eliminates the need for additional external authentication devices or complex multi-party coordination infrastructure.