Mobile Authentication Agent for Phishing-Resistant Login Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user and service authentication methods, particularly those relying on SMS-based authentication and password management, are vulnerable to hacking and phishing attacks, leading to security breaches and user inconvenience.
Innovation Solution
A system and method that authenticates users by verifying SMS authentication values and IP addresses, using push notifications, and ensuring that authentication requests originate from legitimate mobile devices within a designated range, thereby enhancing security and user control over access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SMS-based authentication is used to verify user identity, then authentication convenience is improved, but security is worsened due to vulnerability to hacking and SMS interception
Solution Approach 1:
The authentication process is divided into two independent parts: device possession authentication (verifying the mobile device belongs to the user) and service authentication (verifying the service is legitimate). This segmentation allows each part to be secured independently, preventing complete authentication bypass even if one part is compromised.
Solution Approach 2:
A verification server acts as an intermediary between the mobile device and the service server. The verification server receives authentication information from the mobile device, verifies device possession, and only then allows the service server to proceed with service authentication. This intermediary prevents direct trust between the service server and user, adding a security layer.
2Measurement precision
If personal information is collected for SMS authentication, then authentication accuracy is improved, but information leakage risk is worsened
Solution Approach 1:
The invention extracts and verifies only the necessary authentication information (device identifier and authentication value) from the mobile device, without collecting or storing sensitive personal information such as name, address, or contact details. This minimizes the attack surface for information leakage while maintaining authentication accuracy through device-bound authentication values.
Solution Approach 2:
The authentication value is designed as a temporary, single-use credential that is valid only for a specific authentication session. After use, the authentication value is discarded and cannot be reused. This prevents long-term storage of sensitive data and limits the impact of potential data breaches to transient authentication events.
3Reliability
If multiple passwords are required for different services, then security is improved, but ease of operation is worsened due to difficulty in password management
Solution Approach 1:
The mobile device performs self-authentication by generating and presenting its own authentication value based on its unique identifier. The device proves its identity and possession without requiring the user to manually provide passwords or authentication credentials. This eliminates the need for users to manage multiple passwords across different services.
Solution Approach 2:
The device possession authentication mechanism serves multiple functions: it authenticates the user's mobile device, verifies the service legitimacy, and enables secure communication between the device and service server. This universal authentication approach replaces the need for service-specific passwords with a single device-based authentication system that works across all services.
4Speed
If authentication values are transmitted via SMS, then authentication speed is improved, but vulnerability to interception is worsened
Solution Approach 1:
The invention replaces the mechanical SMS transmission system with a direct device-to-service authentication mechanism. Instead of transmitting authentication values through the SMS network (which can be intercepted), the mobile device directly provides its authentication value to the verification server through secure communication channels, eliminating the transmission vulnerability inherent in SMS-based systems.
Data Source
AI summary
An authentication system performing user-centered authentication may include: an authentication service component acting as an authentication procedure of an online service server; and a mobile authentication agent component acting as the authentication procedure of an access terminal which accesses the online service server. Herein, the authentication service component may confirm a mobile authentication agent component corresponding to user information input from the access terminal as basic authentication information, transmit an authentication password value to each of the confirmed mobile authentication agent component and the online service server which the access terminal intends to access, and transmit an authentication success message to the online service server when a password verification value or an authentication agreement value corresponding to the authentication password value is received from the mobile authentication agent component.