One-Time Credential Authentication for Phishing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods, such as Microsoft's SmartScreen filter, face challenges in detecting new phishing servers and can be slow, leading to user hesitation and potential breaches of personal information.
Innovation Solution
A user authentication method that uses one-time credential certification between a client terminal and a server, without requiring password transmission, to prevent phishing and pharming attacks, and is resistant to replay and man-in-the-middle attacks, utilizing hash values and exclusive disjunction operations for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SmartScreen filter uses a list of previously registered phishing servers for detection, then it can reduce cases of users falling victim to phishing scams, but it cannot detect phishing if the URL of a new phishing server is not registered on the list
Solution Approach 1:
The server performs preliminary actions by generating and storing hash values of domain names before phishing attempts occur. When a user accesses a server, the client terminal calculates the hash value of the domain name and compares it with the pre-stored hash value, enabling detection of new phishing servers without requiring prior registration on a blacklist.
Solution Approach 2:
The patent introduces hash values as an intermediary element between the client terminal and server for authentication. Instead of directly comparing domain names or relying on blacklist matching, the system uses hash values as a mediator to verify server identity, enabling both new and existing phishing server detection.
2Reliability
If SmartScreen filter searches the phishing server list every time the user accesses a server, then it can detect phishing servers, but it can take a long time to load the main page of a server
Solution Approach 1:
The system performs preliminary authentication by comparing hash values before the user accesses the server content. The client terminal calculates the hash value of the domain name and compares it with the pre-stored hash value received from the server, completing the authentication process quickly without requiring time-consuming blacklist searches during server access.
Solution Approach 2:
The patent extracts the essential authentication function from the complex blacklist search process. Instead of searching through entire phishing server lists during each access, the system extracts and compares only the critical hash value elements, significantly reducing authentication time while maintaining detection accuracy.
3Reliability
If the authentication system uses encryption keys such as private key and public key for security, then it can provide secure authentication, but it results in lower authentication speed
Solution Approach 1:
The patent replaces the complex cryptographic mechanism (private key and public key encryption) with a simpler hash value comparison mechanism. Instead of performing computationally intensive encryption and decryption operations, the system calculates hash values and compares them directly, achieving both high security and fast authentication speed.
Solution Approach 2:
The system changes the authentication parameter from encrypted key pairs to hash values. By transforming the authentication data into hash format, the system achieves comparable security with significantly reduced computational overhead, enabling faster authentication while maintaining reliability.
4Reliability
If the system transfers password for user authentication to the server, then it can verify user identity, but it creates vulnerability to phishing and pharming attacks that breach personal information
Solution Approach 1:
The patent extracts the authentication function from the password itself and replaces it with hash value comparison. Instead of transferring and verifying actual passwords between client and server, the system uses hash values as a substitute, eliminating the security vulnerability of password transmission while maintaining identity verification capability.
Solution Approach 2:
The hash value serves as an intermediary between the user's password and the server's verification system. The client terminal calculates the hash value of the domain name and compares it with the pre-stored hash value, enabling secure authentication without exposing the actual password to potential phishing or pharming attacks.
Data Source
AI summary
A user authentication method and apparatus are disclosed. One embodiment of the invention can provide a method for authenticating a user from a server that includes: (a) transmitting a one-time server certification message in response to an authentication request including a user ID of a client terminal, and receiving a one-time terminal certification message from the client terminal; and (b) authenticating the user by verifying the one-time terminal certification message by using a hash value stored beforehand in correspondence to the user ID.