QR Code Session Verification for Phishing-Resistant Login
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User credentials are at high risk of being stolen due to phishing attacks, where unauthorized computing devices intercept and misuse user credentials to access sensitive information.
Innovation Solution
A method and system that verify communication paths using session identifiers and quick response (QR) codes, where a mailbox server facilitates communication between user devices and a relying party server, preventing unauthorized access by ensuring that session IDs match across all communication channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional login methods are used, then ease of operation is improved, but security against phishing attacks deteriorates
Solution Approach 1:
A mailbox server is introduced as an intermediary between the user device and the relying party server. The mailbox server receives user credentials and session identifiers, generates QR codes, and verifies communication paths. This intermediary prevents direct credential transmission to phishing sites while maintaining convenient login functionality through QR code scanning.
Solution Approach 2:
The system implements feedback mechanisms where the relying party server provides QR codes to the user device, the user device scans these QR codes with a second device, and the mailbox server verifies session identifiers. This multi-step feedback loop ensures the user is interacting with the legitimate relying party server rather than a phishing site.
2Reliability
If session identifier verification is implemented, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The system uses QR codes as a simplified copy of session identifiers. Instead of directly transmitting and verifying complex session identifier strings across multiple devices, the patent encodes session identifiers into QR codes that can be easily scanned and processed by mobile devices, reducing the complexity of verification operations.
Solution Approach 2:
The verification process is segmented into distinct functional components: the relying party server generates QR codes, the user device displays and scans them, the mailbox server receives and verifies session identifiers, and the relying party server makes final authentication decisions. This segmentation allows each component to handle a specific part of the verification process independently.
Data Source
AI summary
In some instances, a method for verifying communication paths is provided. The method comprises: obtaining, from a first user device, a request to access content associated with a relying party system, wherein the request indicates user credentials and a first session identifier (ID); obtaining one or more quick response (QR) codes and a second session ID associated with a first QR code of the one or more QR codes, wherein the relying party system generates and provides the first QR code to the first user device; and verifying the first session ID and the second session ID, wherein the relying party system grants the first user device access to the requested content based on the verification.