Password Reset Method Preventing Account Enumeration via Fake Confirmation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password reset mechanisms are vulnerable to attacks, allowing hackers to exploit them even if they fail to crack the original password, leading to security risks and poor user experience due to unclear account validity feedback.
Innovation Solution
A password reset method that provides users with confirmation information associated with their accounts for verification, while generating fake confirmation information for invalid accounts to prevent account enumeration and ensure user understanding of account ownership, thus enhancing security and user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the system provides clear feedback on account validity during password reset, then user experience is improved, but security is worsened due to account enumeration attacks
Solution Approach 1:
The patent applies local quality by providing different types of feedback information to different users based on their authentication status. Legitimate users receive detailed confirmation information (account name, email, phone number) to verify ownership, while attackers receive only generic success messages. This localized differentiation resolves the contradiction by giving users the information they need for verification without exposing system vulnerabilities to attackers.
2Ease of operation
If the system sends verification information to multiple communication addresses, then user experience is improved by providing multiple verification channels, but security is worsened due to increased attack surface
Solution Approach 1:
The patent applies preliminary action by pre-configuring multiple communication addresses (email, phone, messaging apps) during account registration or profile setup. When password reset is initiated, the system proactively sends verification codes to all pre-configured addresses simultaneously. This resolves the contradiction by establishing verification channels in advance, so users can choose their preferred method without exposing the system to real-time probing attacks.
Solution Approach 2:
The patent applies copying by creating duplicate verification instances across multiple communication channels. Instead of sequentially checking each channel, the system generates and sends independent verification codes to email, phone, and messaging app addresses simultaneously. Each verification code is a copy of the authentication mechanism adapted to its specific channel, allowing users to verify through any channel without increasing the overall attack surface.
3Ease of operation
If the system allows password reset without additional verification, then user experience is improved by simplifying the process, but security is worsened due to unauthorized password changes
Solution Approach 1:
The patent applies the intermediary principle by introducing a verification code as a mediator between the user's password reset request and the actual password change. The verification code is sent to pre-configured communication addresses and must be entered to proceed with password reset. This intermediary step resolves the contradiction by maintaining process simplicity for legitimate users while adding a security layer that prevents unauthorized password changes without requiring complex multi-factor authentication protocols.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application provides a password reset method, a requester, and a verifier. The method includes: receiving, by a verifier, an account for requesting password reset; and when determining that the account is a valid account, sending, by the verifier, first confirmation information to the requester, where the first confirmation information is used to enable the requester to display, to a user, first binding information associated with the account, and request the user to determine whether to send verification information to a first communication address associated with the account; or when determining that the account is an invalid account, generating, by the verifier based on the account, second binding information corresponding to the account, and sending, to the requester, second confirmation information having a same form as the first confirmation information, where the second confirmation information is used to enable the requester to display the second binding information to the user, and request the user to determine whether to send verification information to a second communication address associated with the account. In embodiments of this application, user experience can be ensured and a password reset vulnerability can be avoided.