OTP Domain Matching for Automated Phishing Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems rely on user vigilance to detect phishing attempts for one-time passwords (OTPs), which is unreliable and prone to failure due to user distraction or inattention.
Innovation Solution
Implementing a system that automatically compares the domain name of the website requesting credentials with the domain name of the OTP server, warning or blocking the entry of OTPs if a mismatch is detected, using a web browser plug-in, smartphone app, and backend server to verify OTP server domain names through a database cross-referenced with crowd-sourced information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated domain comparison is implemented to detect phishing attempts, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary OTP phishing protection system that acts as a mediator between the user and the OTP entry process. This system includes a database component that stores legitimate OTP server domain names and receives OTP requests, automatically comparing the requested domain against stored legitimate domains to detect phishing attempts. By placing this intermediary layer, the system achieves automated security verification without requiring complex user-side implementations, thus improving reliability while managing device complexity.
2Reliability
If domain name comparison is performed automatically, then protection effectiveness is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-populating a database with legitimate OTP server domain names before the actual OTP entry process begins. When an OTP request is received, the system performs a straightforward lookup comparison against this pre-established list of legitimate domains. This approach allows for rapid domain verification without requiring complex real-time analysis, thus maintaining protection effectiveness while minimizing additional processing time.
3Device complexity
If user vigilance is relied upon to detect phishing, then system simplicity is maintained, but security reliability deteriorates
Solution Approach 1:
The patent implements self-service by enabling the OTP phishing protection system to automatically perform domain comparison and detect phishing attempts without requiring user intervention or vigilance. The system autonomously receives OTP requests, compares domains against the database of legitimate OTP server domains, and identifies phishing attempts. This automation maintains relative system simplicity while dramatically improving security reliability by eliminating dependence on user awareness and attention.
Data Source
AI summary
A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to identify a first domain name associated with a website that served a login form to a web browser. The at least one processor is further configured to identify a one-time password (OTP) entry request served from the website in response to transmitting user credentials to the website. The at least one processor is further configured to identify a second domain name associated with an OTP server that provided an OTP. The at least one processor is further configured to perform a security action in response to determining that the first domain name differs from the second domain name. The security action may include blocking a response to the OTP request from the website, providing a warning, and/or obtaining confirmation for the response to the OTP entry request.