Mutual Authentication via Inner Page Passphrase

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing authentication systems are vulnerable to phishing attacks, man-in-the-middle attacks, and CSS overlay attacks, which compromise user credentials, and lack a secure mechanism for mutual authentication across multiple sites and domains.

Innovation Solution

An embeddable mutual authentication mechanism using an Inner Page and Outer Page framework, where the Inner Page is served by the authenticating domain, performs actual authentication, and includes a passphrase to verify the server's authenticity, while preventing CSS-based attacks through dynamic content and secure cookie transmission.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a passphrase is displayed on the authentication page to verify server authenticity, then the user can identify legitimate servers, but the passphrase can be captured by attackers through man-in-the-middle attacks or CSS overlay attacks

Engineering Contradiction:

Improveserver authentication reliabilityVSAvoidcredential capture vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The authentication system is divided into two separate pages: an Outer Page that provides the user interface and an Inner Page that handles secure authentication. This segmentation isolates the passphrase display and credential collection on the secure Inner Page, preventing attackers from capturing credentials through CSS overlays on the Outer Page.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The Inner Page is embedded within the Outer Page using an iframe or similar embedding mechanism. The Inner Page contains the secure authentication form with the passphrase, while the Outer Page provides the overall user interface. This nesting allows the secure Inner Page to be isolated from CSS attacks on the Outer Page while still being integrated into the user's view.

Inventive Principle:

Principle #7Nested doll (Nesting)

2Ease of operation

If the authentication page is embedded in another page controlled by the attacker, then the attacker can overlay content to capture credentials, but cross-domain security should prevent direct access

Engineering Contradiction:

Improveembedded authenticationVSAvoidCSS overlay attack

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The Inner Page has distinct security properties compared to the Outer Page. It is served from a different domain and has its own security context, which prevents CSS from the Outer Page from affecting its layout or capturing its form inputs. This local quality difference creates a security boundary that blocks CSS overlay attacks.

Inventive Principle:

Principle #3Local quality

3Reliability

If the Inner Page is served by the authenticating domain, then mutual authentication is achieved, but the system complexity increases across multiple sites and domains

Engineering Contradiction:

Improvemutual authenticationVSAvoidfederated system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The Inner Page serves multiple functions: it displays the passphrase for user verification, collects authentication credentials, and transmits them securely to the authenticating server. This multi-functionality reduces the need for separate components for each function, simplifying the overall system architecture despite the federated nature.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The Inner Page acts as an intermediary between the user and the authenticating server. It is served from the authenticating domain, allowing the server to verify the user's credentials while the user interacts with it through the embedded Outer Page. This intermediary role enables mutual authentication without requiring direct complex interactions between multiple domains.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8332627B1Mutual authentication

Publication Date: 2012.12.11 CISCO TECHNOLOGY INC

AI summary

Mutual authentication systems and methods are described that comprise an authenticating server that is available across a network and capable of authenticating a user based on credentials provided by the user. An embeddable object provided by the authenticating server and containing a passphrase that identifies the server to the user. A credentials entry mechanism identifies the user to the authenticating server. A user device displays an Outer Page that can request authentication. The authenticating server verifies the source of the request and provides the passphrase to the user device. The display of the passphrase confirms the identity of the authenticating server to the user. The source of the request can be verified using a secure cookie. The embeddable object can be provided in a second page and can prevent display of the passphrase if user input is not directed to the second page.