One-Time JavaScript Authentication Guarding Against Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for web applications are insecure, particularly during client-server connections over insecure networks, as they rely on user passwords and one-time passwords, which are vulnerable to advanced attacks such as man-in-the-middle attacks and phishing, and lack robust security mechanisms for user authentication in devices like desktop computers and mobile devices.
Innovation Solution
A secure input routine using One-Time JavaScript (OT-JS) code with a unique one-time token is implemented, executed by web browsers, which includes JSON code guarded by a server-side application to ensure secure authentication, incorporating behavioral authentication and obfuscation techniques to prevent malicious tampering and brute force attacks, and includes a Remote Access Detection module to detect unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional password authentication is used for web applications, then ease of operation is improved, but security is worsened due to vulnerability to man-in-the-middle attacks and phishing
Solution Approach 1:
The system performs preliminary actions by embedding OT-JS code with one-time tokens in the web page before user interaction. The code is prepared with unique identifiers and cryptographic elements in advance, enabling automatic authentication without exposing passwords during transmission
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using OT-JS code that acts as a mediator between the user and the authentication system. This code includes embedded one-time tokens and cryptographic elements that enable secure verification without directly transmitting sensitive password information over the network
2Adaptability or versatility
If JSON code is executed by JavaScript interpreter for authentication, then functionality is improved, but security is worsened due to exposure to malicious scripts
Solution Approach 1:
The patent employs disposable one-time tokens embedded in OT-JS code that are valid for a single authentication attempt only. After use, these tokens become invalid, preventing replay attacks. The code includes unique identifiers that are discarded after one authentication cycle, eliminating the security risk of reusable authentication data
Solution Approach 2:
The system dynamically changes cryptographic parameters including one-time tokens, unique identifiers, and cryptographic keys for each authentication session. This parameter variation ensures that even if one session is compromised, other sessions remain secure, and malicious scripts cannot exploit static vulnerabilities
3Reliability
If One-Time JavaScript code with one-time token is used for secure input routine, then security is improved, but device complexity is worsened
Solution Approach 1:
The OT-JS code is designed to perform multiple functions within a single authentication mechanism: it provides cryptographic verification, implements one-time token validation, enables behavioral biometric analysis, and prevents replay attacks. This multi-functionality consolidates what would otherwise require separate security mechanisms into one unified system
Data Source
AI summary
A computer-implemented method, program-code, web-client device and computer system to realize and guard over a secure input routine based on their behavior.