Password Interception Component for Phishing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing attacks continue to pose a significant threat as users often unknowingly submit sensitive credentials to fraudulent websites, with existing technologies focusing more on user behavior change rather than technological solutions to prevent password leakage.
Innovation Solution
A software component deployed on computing devices connects to a centralized cloud service to maintain a list of trusted websites, intercepts password submissions, and generates warnings for unknown websites, using key-stretching algorithms to secure stored credentials and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing anti-phishing technologies focus on user behavior change, then user awareness may improve, but technological prevention of password leakage remains insufficient
Solution Approach 1:
The patent introduces a password interception component as an intermediary between the user and the website. This component captures passwords before they are transmitted, analyzes them locally, and only allows transmission if the website is verified as legitimate. This intermediary mechanism provides technological prevention without requiring complex user behavior changes.
Solution Approach 2:
The password interception component performs self-service by autonomously capturing, analyzing, and validating passwords without user intervention. It automatically compares captured passwords against a database of known legitimate website passwords and makes decisions to block or allow transmission, reducing the need for user awareness while maintaining security.
2Reliability
If a password interception component is implemented, then password leakage can be prevented, but device complexity increases
Solution Approach 1:
The patent divides the anti-phishing system into separate functional modules: a password interception component that captures passwords, a password analysis component that validates them, and a centralized service that maintains databases of legitimate passwords. This segmentation allows each component to perform its specific function efficiently without requiring the entire system to be complex.
Solution Approach 2:
The password interception component serves as an intermediary layer between the user's browser and the website, capturing passwords before they are transmitted. This intermediary approach prevents password leakage without requiring changes to the browser or website infrastructure, keeping the added complexity localized to a single component.
3Reliability
If passwords are captured and analyzed before transmission, then password leakage is prevented, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-capturing passwords before they are transmitted to the website and pre-analyzing them against the database of legitimate passwords. This preliminary validation ensures that only passwords for legitimate websites are transmitted, preventing phishing attacks without requiring time-consuming verification during the login process.
Solution Approach 2:
The password analysis component performs self-service by autonomously and rapidly comparing captured passwords against the centralized database using efficient matching algorithms. This automated process minimizes processing time while ensuring thorough verification, preventing password leakage without significantly delaying the login experience.
Data Source
AI summary
A computer-implemented method of preventing leakage of user credentials to phishing websites may comprise capturing user credentials input to website; updating a stored list of trusted website credentials upon determining that the domain of the URL of the website is present in a stored list of trusted websites; generating a hash of the captured user credentials; determining whether the hashed user credentials matches one of the hashed user credentials in the list of trusted website credentials; and when a match is found, requesting input whether the website is trusted or whether the website is unknown and/or untrusted; sending the URL to a remote computer server when the input indicates that the website is unknown and/or untrusted and disallowing submission of the user credentials to the website; adding the domain of the URL to the stored list of trusted websites, adding the generated hash of the captured user credentials to a stored list of trusted website credentials and allowing submission of the user credentials to the website.