One-Time Password Authentication for Mobile Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile network devices, such as cellular telephones, are vulnerable to phishing attacks due to the lack of URL display, which prevents users from verifying the authenticity of websites, making them susceptible to deception and data theft.
Innovation Solution
A method and system that generates and compares one-time passwords (OTPs) between a mobile network device and a website server, using an initial seed to authenticate the website, ensuring that only the intended website can produce a matching OTP, thus verifying its legitimacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If URL display is omitted from mobile web pages to reduce content and improve display efficiency, then device complexity and content volume are reduced, but user ability to verify website authenticity deteriorates
Solution Approach 1:
The patent introduces a third-party authentication service as an intermediary between the user and the website. This service generates and distributes authentication tokens to mobile devices, enabling verification of website authenticity without requiring direct display of URLs on the mobile device. The intermediary handles the complex verification logic centrally, allowing simplified mobile web pages while maintaining security.
Solution Approach 2:
The patent replaces the mechanical visual verification system (direct URL display on the screen) with a cryptographic authentication system. Instead of relying on users to visually inspect and compare URLs, the system uses mathematical cryptographic tokens and algorithms to verify website authenticity automatically and securely.
2Ease of operation
If URL is not displayed on mobile devices to simplify interface, then ease of operation is improved, but vulnerability to phishing attacks increases
Solution Approach 1:
The patent implements a feedback mechanism where the authentication service continuously monitors and communicates with mobile devices. When a user visits a website, the system provides feedback in the form of authentication tokens that indicate whether the website is legitimate. This feedback loop enables security verification without requiring direct URL display, maintaining interface simplicity while preventing phishing.
Solution Approach 2:
An authentication service intermediary is introduced between the mobile device and the website. This intermediary generates and manages cryptographic authentication tokens, providing a layer of security that operates independently of the visible web page interface. The intermediary handles the complex security protocols while the mobile device displays a simplified interface.
3Reliability
If one-time password generation and comparison is implemented to authenticate websites, then phishing protection is improved, but device complexity and computational requirements increase
Solution Approach 1:
The patent segments the authentication system into separate functional components: a centralized authentication service that generates cryptographic tokens and mobile devices that store and verify them. This segmentation allows complex cryptographic operations to be performed on powerful servers rather than on resource-constrained mobile devices, reducing the computational burden on the device while maintaining high security.
Solution Approach 2:
The patent uses short-lived cryptographic tokens that are generated once and then discarded. These one-time passwords are inexpensive to generate and validate, providing strong authentication without requiring complex long-term cryptographic key management on the mobile device. The tokens are designed to be used once and then discarded, simplifying the device's security architecture.
Data Source
AI summary
Embodiments of systems and methods for client and/or server authentication are provided. In one embodiment, a method includes sending information from a mobile network device to a server, wherein the information comprises a seed that is used by both the mobile network device and the server to compute a series of one time passwords. The method also includes receiving, by the mobile network device, a succession of one time passwords generated by the server throughout a session. And the method further includes comparing the received one time passwords generated by the server throughout the session to corresponding one time passwords generated at the mobile network device. In this manner, the server can be authenticated. In various embodiments, the process may be reversed to facilitate client, e.g., mobile network device, authentication.