Two-Stage Authentication Using QR Code and Asymmetric Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network information systems rely on single-factor authentication, making user login information vulnerable to theft and phishing attacks, especially when accessed from compromised devices.
Innovation Solution
A two-stage authentication method involving anonymous verification of a random verification code followed by user name and password authentication, utilizing QR code technology and asymmetric encryption to enhance security without increasing user complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If single-factor authentication (username and password) is used, then the login process is simple and fast, but the security is low and vulnerable to phishing attacks and information disclosure
Solution Approach 1:
The authentication process is segmented into two distinct stages: first-stage anonymous authentication using a random verification code, and second-stage identifying information authentication using username and password. This segmentation allows the system to achieve multi-factor authentication without requiring users to input credentials directly on the client device, thereby improving security while maintaining operational simplicity.
Solution Approach 2:
A random verification code acts as an intermediary element between the client device and the authentication server. This verification code enables anonymous authentication in the first stage, allowing the system to verify user identity without transmitting or storing sensitive credentials on the client device, thus preventing information disclosure even if the client is compromised.
2Reliability
If username and password are transmitted directly on the client device, then the login process is straightforward, but the risk of information leakage increases when the client is infected with malware
Solution Approach 1:
The sensitive username and password information is extracted from the client device and transmitted through a secure channel to the authentication server only after successful first-stage anonymous authentication. This extraction prevents malware on the client device from intercepting credentials, as the credentials are never stored or processed locally.
Solution Approach 2:
The system performs preliminary anonymous authentication using a random verification code before allowing the transmission of identifying information. This preliminary action establishes a secure authentication state, ensuring that only after successful verification can the system proceed to handle sensitive credentials, thereby preventing information leakage.
3Reliability
If verification code authentication is implemented, then the risk of phishing attacks is reduced, but the authentication process becomes more complex
Solution Approach 1:
The authentication mechanism is segmented into two stages where the first stage uses a random verification code for anonymous authentication, and the second stage uses username and password for identifying information authentication. This segmentation achieves multi-factor authentication without requiring complex user interactions, as the verification code is automatically generated and processed by the system.
Data Source
AI summary
A method is provided to improve authentication of a user to login with a client device to a computer system. A mobile device stores a list of Uniform Resource Locators (URLs), user names and passwords. The mobile device reads an authentication code displayed on a display of the client device to extract a URL and a session identifier (ID), searches a user name and a password associated with the URL in the list of URLs, user names and passwords, transmits the user name, the password, and the session ID to a gateway server when the user name and the password associated with the URL are found in the list, and authenticates the user to login to the computer system with the client device when the client device retrieves from the gateway server the user name and the password.