Mutual OTP Authentication Against Pharming via Server Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current one-time password (OTP) authentication methods lack enhanced security, particularly in preventing pharming attacks where users are tricked into inputting OTPs on fake websites, and existing solutions complicate user verification processes.
Innovation Solution
A system and method that generates and verifies server inspection OTPs and user OTPs using shared or different generation keys and conditions, displayed distinctly on a user's device to ensure authenticity of the online service server, and includes a simpler authentication scheme using a software authenticator to verify service legitimacy without requiring additional password or biometric input.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hardware dongle scheme is used for OTP authentication, then security effect is high, but carrying is inconvenient and cost is generated
Solution Approach 1:
The patent replaces the hardware dongle (mechanical/physical authentication device) with a software application running on a user terminal. The OTP generation function previously requiring a physical device is now implemented through software that can execute on standard mobile devices, eliminating the need for carrying separate hardware while maintaining authentication capability.
Solution Approach 2:
The software application scheme allows the user terminal to serve multiple purposes - both as the primary device for accessing online services and as the OTP generation device. This multi-functionality eliminates the need for a separate dedicated hardware authentication device, improving portability and convenience.
2Ease of manufacture
If a software application scheme is used for OTP authentication, then cost is low, but security effect is slightly lower
Solution Approach 1:
The patent implements dynamic OTP generation where the authentication code changes based on real-time factors such as the current time and random values. This dynamic behavior prevents static analysis and replay attacks, significantly enhancing the security of the software-based solution compared to traditional static or predictable OTP systems.
Solution Approach 2:
The patent introduces an authentication server as an intermediary that manages the OTP generation process. The server generates OTPs based on secure algorithms and time synchronization, acting as a trusted mediator between the user terminal and the online service server. This architecture enhances security by centralizing the cryptographic operations and ensuring proper key management.
3Ease of operation
If traditional OTP authentication is used, then authentication process is simple, but vulnerability to pharming attacks increases
Solution Approach 1:
The patent implements preliminary verification of the online service server's authenticity before the actual OTP authentication takes place. The authentication server verifies the server's identity and establishes a secure connection in advance, ensuring that the user is communicating with the legitimate service provider. This preliminary action prevents pharming attacks where users might be redirected to fake websites.
Solution Approach 2:
The patent incorporates feedback mechanisms where the authentication server continuously monitors and verifies the authenticity of communication channels. The system provides feedback to the user terminal about the security status of the connection, allowing real-time detection and prevention of pharming attacks while maintaining the simplicity of the authentication process for the user.
Data Source
AI summary
Provided is a computer implemented method for performing mutual authentication between an online service server and a service user, including: (a) generating, by an authentication server, a server inspection OTP; (b) generating, by an OTP generator, a verification OTP having the same condition as the server inspection OTP and using the same generation key as an OTP generation key and a calculation condition different from a calculation condition is applied or a generation key different from the OTP generation key is used and the same calculation condition as the calculation condition used for generating the server inspection OTP is applied to generate a user OTP; and (c) generating, by the authentication server, a corresponding OTP having the same condition as the user OTP and comparing whether the generated corresponding OTP and the user OTP match each other to authenticate the service user.