Login Page Interception for Secure Credential-Free Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User devices are vulnerable to Trojans and malware that allow attackers to steal credentials, making it difficult to identify the attacker and exposing user credential data during login, which existing security systems fail to adequately protect.
Innovation Solution
A security system intercepts network traffic, identifies login pages, generates modified pages to remove credential entry fields, and implements two-factor authentication using a designated device, even for websites lacking such security, while storing credentials securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user credentials are transmitted during login to websites, then authentication functionality is enabled, but credential exposure to attackers increases
Solution Approach 1:
The system introduces an intermediary component that sits between the user device and the website server. This intermediary intercepts login requests, modifies them to remove credential fields, and manages credential transmission securely. The intermediary acts as a trusted mediator that protects credentials from exposure while enabling authentication functionality.
Solution Approach 2:
The system performs preliminary actions by pre-configuring profiles for target websites that include authentication credentials and page modification instructions. Before actual login attempts, the system prepares modified login pages that exclude credential entry fields, and stores authentication data in advance for secure transmission only when necessary.
2Ease of operation
If login pages with credential entry fields are provided to users, then user authentication is enabled, but credential theft risk increases
Solution Approach 1:
The system extracts and removes the credential entry fields from the login page HTML structure. By taking out the problematic elements (username and password input fields) from the page, the system prevents credential theft while maintaining the ability to authenticate users through alternative secure mechanisms.
Solution Approach 2:
The system creates a modified copy of the original login page that preserves the visual appearance and functionality of the site but removes credential entry fields. This copied version is presented to the user device, allowing authentication to proceed through the intermediary without exposing credentials to potential attackers.
3Object-affected harmful factors
If HTTPS interception is performed for all websites, then credential protection is enhanced, but system complexity and processing overhead increase
Solution Approach 1:
The system applies HTTPS interception and page modification selectively only to specific target websites that are configured in profiles, rather than uniformly to all websites. This localized approach reduces system complexity and processing overhead while maintaining enhanced credential protection where it is most needed.
Solution Approach 2:
The system changes the parameter of interception applicability from universal to selective based on website identification. By modifying which websites undergo interception (those with configured profiles), the system balances credential protection with reduced complexity and processing requirements.
Data Source
AI summary
An authentication system has instructions including, in response to receiving a page request, determining a page identifier based on the page request and comparing the page identifier to a set of pages. The instructions include, in response to the page identifier matching a first page of the set of pages, obtaining a first profile corresponding to the first page and retrieving the first page from a first website corresponding to the first page. The instructions include, based on the first page, generating a new page according to the first profile and transmitting the new page to the browsing device. The instructions include, in response to receiving a selection from the new page on the browsing device, forwarding login credentials of the first profile to the first website and, in response to receiving a return page from the first website, forwarding the return page to the browsing device for display.