Intermediary Server Mitigating Man-in-the-Browser Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication and authorization systems are vulnerable to Man-in-the-Browser (MitB) threats, which cannot be effectively mitigated by existing security mechanisms without significant expense or usability impairment, and there is a need for a solution that enhances security across multiple service providers without requiring multiple hardware tokens.
Innovation Solution
A method that involves a computer-implemented system with a second server that manages user account status and authentication, using a secure channel for mutual authentication between servers and requiring a second factor authentication, such as One-Time Passwords (OTPs), to prevent unauthorized access and ensure operation integrity, allowing users to manage their accounts securely across different service providers with a single device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing authentication and authorization schemes are adopted, then flexibility and robustness in assigning permissions are achieved, but vulnerability to Man-in-the-Browser (MitB) attacks remains
Solution Approach 1:
The patent introduces a dedicated program acting as an intermediary component between the user and the authorization system. This intermediary verifies operation integrity by checking whether user actions match the authorized permissions, thereby preventing MitB attacks without restricting the flexibility of existing authorization schemes like OAuth.
Solution Approach 2:
The authentication and authorization process is segmented into distinct components: the existing authorization scheme handles permission assignment, while the newly introduced dedicated program handles operation integrity verification. This segmentation allows each component to specialize in its function without compromising the other.
2Reliability
If strong security mechanisms are implemented to protect against MitB attacks, then security level is enhanced, but cost and complexity increase significantly
Solution Approach 1:
Instead of requiring expensive hardware tokens, the patent uses a software-based dedicated program that replicates the security verification function. This program runs on the user's existing device and performs the same integrity checking that hardware tokens would provide, but without the associated cost and complexity.
Solution Approach 2:
The dedicated program leverages existing system resources and user device capabilities to perform security verification. It uses the user's existing authentication credentials and the authorization system's permission data to independently verify operation integrity, without requiring additional external security infrastructure.
3Reliability
If multiple hardware tokens are used to secure accounts across different service providers, then security is improved, but usability and ease of operation deteriorate
Solution Approach 1:
The dedicated program serves as a universal security solution that works across multiple service providers and authorization schemes. Instead of requiring separate hardware tokens for each provider, this single software component provides security verification for all authorized services, simplifying the user experience while maintaining security.
4Manufacturing precision
If authentication exposure time is extended to allow complete verification, then authorization completeness is improved, but vulnerability to attacks increases
Solution Approach 1:
The dedicated program performs preliminary checks on operation integrity before the authentication process completes. By verifying that the user's intended action matches authorized permissions in advance, the system can make faster authorization decisions without exposing the system to attacks during extended verification periods.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer implemented method and computer program products to prevent attacks against authorization systems The computer implemented method comprising controlling the access to different resources and actions defined for a user by a first server, reducing the exposure time at which such operations are available and establishing a dual channel verification, through the use of a second server, to preferably mitigate Man in the Browser threats. The computer programs implement the method.