Location Reputation Authentication for Phishing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks compromise user accounts by stealing credentials, leading to unauthorized access and financial losses, as existing countermeasures are inadequate in distinguishing legitimate from illegitimate user sessions.
Innovation Solution
The system authenticates user sessions based on historical data by identifying safe locations associated with user accounts, requiring higher authentication for sessions originating from unfamiliar or suspicious locations, and updating the database with new safe locations after successful authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used, then ease of operation is maintained, but reliability against phishing attacks deteriorates
Solution Approach 1:
The system pre-establishes a reputation database containing location information and safety ratings for various IP addresses before authentication occurs. When a login attempt is made, the system queries this pre-built database to quickly determine if the location is suspicious, enabling fast authentication decisions without adding significant operational steps for users.
Solution Approach 2:
The patent introduces an intermediary reputation database that acts as a mediator between the user and the authentication system. This database stores pre-analyzed location reputation data, allowing the system to make informed authentication decisions based on location trustworthiness without requiring complex real-time analysis, thus maintaining ease of operation while improving reliability.
2Reliability
If enhanced authentication procedures are implemented, then reliability improves, but device complexity increases
Solution Approach 1:
The system applies different levels of authentication scrutiny based on the local quality or reputation of the incoming IP address. Locations with good reputations receive standard authentication treatment, while locations flagged as suspicious in the reputation database trigger enhanced authentication procedures. This selective approach improves reliability for risky sessions without unnecessarily complicating the overall system or affecting legitimate users.
Solution Approach 2:
The patent changes the parameter of authentication strictness dynamically based on location reputation data. Instead of using a fixed authentication protocol, the system adjusts the authentication requirements according to the trust level of the incoming location, as determined by the reputation database. This allows enhanced authentication to be applied only where needed, improving reliability without uniformly increasing system complexity.
3Productivity
If location-based filtering is applied, then productivity of phishing prevention improves, but loss of information increases
Solution Approach 1:
The system applies location-based filtering partially, only to sessions originating from IP addresses present in the reputation database. Rather than blocking all sessions from certain locations or requiring authentication from everyone, the system selectively applies enhanced scrutiny only where reputation data indicates potential risk. This partial application improves phishing prevention productivity while minimizing the loss of legitimate session information.
Solution Approach 2:
The reputation database is pre-populated with location information and safety ratings before authentication decisions are made. This preliminary preparation allows the system to quickly identify and flag suspicious locations without needing to analyze every session in real-time, improving phishing prevention efficiency while reducing the risk of mistakenly blocking legitimate sessions due to insufficient data.
Data Source
AI summary
User sessions are authenticated based on locations associated with a user account used for sending a request for creating a session. Examples of locations of a source of a request include a geographical location, a network address, or a machine cookie associated with a device sending the request. Locations of the request are compared with stored safe locations associated with the user account and a suspiciousness index is determined for the session. The level of authentication required for the session is determined based on the suspiciousness index. Locations are associated with a reputation based on past history of sessions originating from the locations. A location associated with a history of creating suspicious session is considered an unsafe location. Reputation of the location originating the session is used to determine the level of authentication required for the session.