Public-Key Device Authentication Against Phishing and Brute Force
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing online identity management systems are insecure and inconvenient, relying on shared secrets and centralized storage, making them vulnerable to phishing, malware, and data breaches.
Innovation Solution
A system using public-key cryptography for device authentication, eliminating the need for centralized storage and shared secrets, with user-controlled devices authenticating identities and enabling out-of-band approval for high-value transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized storage of personal information is used, then convenience of online transactions is improved, but security against phishing and data breaches deteriorates
Solution Approach 1:
The patent extracts the security vulnerability by removing centralized storage of personal information. Instead of storing personal information centrally, the system uses distributed device identifiers and public-key cryptography, eliminating the single point of failure while maintaining transaction convenience through decentralized authentication
Solution Approach 2:
The patent segments the authentication system into multiple independent components: device identifiers stored locally on devices, public keys distributed across the system, and cryptographic proof mechanisms. This segmentation prevents centralized compromise while enabling convenient online transactions through distributed trust
2Device complexity
If shared secrets are used for authentication, then simplicity of authentication is improved, but vulnerability to key logging and malware attacks worsens
Solution Approach 1:
The patent replaces the mechanical/shared secret authentication system with a cryptographic public-key system. Instead of relying on shared secrets that can be intercepted by key loggers or malware, the system uses asymmetric cryptography where private keys never leave their devices and authentication is performed through cryptographic proofs rather than secret exchange
Solution Approach 2:
The patent introduces cryptographic protocols as intermediaries between authentication parties. Rather than directly sharing secrets, devices communicate through cryptographic challenges and proofs, with the cryptographic system acting as an intermediary that eliminates the need for vulnerable secret transmission while maintaining authentication simplicity
3Ease of operation
If passcode guessing is allowed without limits, then ease of device access is improved, but security against brute force attacks deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-establishing device identifiers and cryptographic credentials during device registration. This preliminary setup enables convenient access for authorized devices while built-in cryptographic verification prevents brute force attacks, as the system can quickly identify and block unrecognized devices before multiple guessing attempts occur
Data Source
AI summary
A method for disabling a device associated with a virtual identity may include receiving, from the device, a request to use the virtual identity, where the request that may include a passcode guess and a device identifier. The method may also include determining that the passcode guess does not authorize use of the virtual identity and incrementing a number of incorrect passcode guesses received within a time interval. The method may additionally include determining that the number of incorrect passcode guesses received within the time interval is greater than or equal to a threshold. The method may further include storing an indication that subsequent requests associated with the device identifier should not authorize use of the virtual identity.