Server Authentication via Password-Derived Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks can counterfeit legitimate websites' login interfaces, allowing hackers to steal users' credentials by mimicking Sitekey, which does not effectively authenticate the server before user input.
Innovation Solution
An authentication method and apparatus that acquire and decrypt server authentication information using specific characters from a user's password, providing feedback to the user before sending an authentication request to the server, ensuring the server's authenticity before user credentials are entered.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Sitekey technology is used to authenticate server identity, then phishing prevention is improved, but the system remains vulnerable to man-in-the-middle attacks where hackers can steal Sitekey and counterfeit login interfaces
Solution Approach 1:
The patent applies preliminary action by having the user decrypt server authentication information during the password input process before actually entering the password. This allows the client to verify server authenticity in advance, preventing man-in-the-middle attacks where hackers could otherwise steal Sitekey and counterfeit login interfaces. The decryption operation serves as a preliminary security check that must succeed before credential submission.
Solution Approach 2:
The patent introduces decryption operation as an intermediary mechanism between the user and the server authentication process. Instead of directly relying on Sitekey, the system uses encrypted server authentication information that requires decryption with password characters as an intermediate step. This intermediary layer prevents direct theft and misuse of authentication credentials by attackers.
2Reliability
If server authentication information is transmitted in encrypted form, then security is improved, but decryption requires additional processing time
Solution Approach 1:
The patent applies partial action by using only a portion of the password (first N characters) for decryption rather than the entire password. This reduces the computational complexity of the decryption operation while maintaining security, as the decryption key is derived from a subset of the password characters. The approach balances security requirements with processing efficiency.
Data Source
AI summary
Authentication methods and apparatuses are provided. The authentication method comprises: acquiring, from a server, first server authentication information of a user, the first server authentication information being encrypted by using at least one first key obtained from a first number of characters in a user password of the user; acquiring the first number of characters input by the user in a password input area; decrypting the first server authentication information by using at least one second key obtained from the first number of characters input; feeding back at least one first authentication response to the user at least according to the decrypted first server authentication information; and sending an authentication request to the server based on a server authentication pass instruction of the user, the authentication request being used to request the server to authenticate the user.