Mobile Terminal Near-Field Authentication for Phishing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User authentication for accessing multiple web services is cumbersome, as users must remember multiple usernames and passwords, and is vulnerable to phishing attacks due to difficulties in verifying URL security indicators, with existing password management solutions being limited in cross-browser usage and susceptible to malicious code access.
Innovation Solution
A method using a mobile terminal with near-field communication to authenticate service access by comparing received service identifiers with a stored set, generating a key for secure communication, and obtaining user consent, thereby preventing unauthorized access and protecting against phishing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users use the same password for multiple services to reduce the number of keys to remember, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent introduces a mobile terminal as an intermediary device that generates and stores service-specific identifiers and keys. Instead of users remembering multiple passwords, the mobile terminal acts as a mediator that provides unique authentication credentials for each service while maintaining security separation. The terminal generates distinct identifiers for different services, allowing users to access multiple services without managing multiple passwords manually.
2Reliability
If users manually verify URLs or security indicators to prevent phishing, then security is improved, but ease of operation is worsened
Solution Approach 1:
The mobile terminal performs self-service authentication by automatically comparing received service identifiers against pre-stored trusted identifiers. The terminal autonomously verifies whether a service is legitimate without requiring user intervention to check URLs or security indicators. This automated verification process maintains high security while significantly improving ease of operation, as users simply need to provide their biometric or PIN for authentication without manually verifying service identities.
3Ease of operation
If password management functions store usernames and passwords in the browser to avoid remembering credentials, then ease of operation is improved, but security is worsened due to exposure to malicious code
Solution Approach 1:
The patent extracts the authentication credential storage function from the browser environment and relocates it to the mobile terminal. By taking out the sensitive storage of service identifiers and keys from the browser, the system eliminates the vulnerability where malicious code in the browser could access stored passwords. The mobile terminal securely stores credentials locally, and only provides them during authentication when the user presents their biometric or PIN, thereby maintaining ease of operation while significantly improving security.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach reduces the need for users to remember multiple credentials, enhances security by preventing phishing, and ensures secure communication between the browser and server without storing sensitive information on the client, thus minimizing the risk of malicious access.
Implementation Method 1
receiving at a mobile terminal, over a bi-directional near-field communication channel between the mobile terminal and a browser
Data Source
AI summary
A method of authenticating access to a service comprises: a) receiving at a mobile terminal, over a bi-directional near-field communication channel between the mobile terminal and a browser, at least part of the identifier of a service; b) comparing, at the mobile terminal, at least part of the identifier received at the mobile terminal with a set of identifiers stored in the mobile device; and c) authenticating access to the service on the basis of whether at least part of the identifier received at the mobile terminal matches an identifier in the set. The mobile terminal may stored a set of URLs, and may compare a received URL (or part URL) with the set of stored URLs. It may generate an alert to the user if at least part of the URL received at the mobile terminal does not match a stored URL. User names and keys are not required to be stored on the web-browser, so the web-browser does not need to maintain a password database. This improves security, since a password database would be vulnerable to malicious code.