Reflective One-Time Password Mitigates MITM Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication schemes using one-time passwords (OTPs) are vulnerable to man-in-the-middle (MITM) phishing attacks, where attackers intercept and use real-time OTPs to access users' accounts, as they do not guarantee that the party submitting the OTP is the actual user.
Innovation Solution
The implementation of a reflective one-time password (ROTP) system, which combines a cryptographic key, OTP information, and reflective information using a secure cryptographic algorithm to generate and verify a user ROTP, ensuring session integrity by entangling the OTP with session context, such as the server's URL or certificate, to differentiate legitimate and phishing attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP authentication is used, then user authentication is provided, but the system is vulnerable to MITM phishing attacks where attackers can intercept and use real-time OTPs
Solution Approach 1:
The patent segments the authentication process into two independent sessions: a first session between the user's device and the phishing server, and a second session between the user's device and the legitimate server. Each session generates its own OTP, preventing the attacker from using OTPs from the first session to authenticate to the second session, thus mitigating MITM phishing attacks
Solution Approach 2:
The patent introduces a session identifier as an intermediary element that binds the OTP to a specific server session. The session identifier is included in the OTP generation process, ensuring that OTPs are session-specific and cannot be transferred or reused across different sessions, thereby preventing phishing attacks
2Adaptability or versatility
If OTPs are transmitted through multiple channels or generated by various devices, then authentication flexibility is improved, but the complexity of the authentication system increases
Solution Approach 1:
The patent implements a universal authentication mechanism that works across multiple devices and communication channels (smartphones, computers, SMS, email, voice calls). The core OTP generation and verification process remains the same regardless of the device or channel used, providing flexibility while maintaining system simplicity through standardized protocols
3Reliability
If real-time OTP generation is implemented, then security against static password attacks is improved, but the system becomes vulnerable to real-time interception attacks
Solution Approach 1:
The patent makes the OTP dynamic by binding it to session-specific parameters including the server's URL, certificate, or other identifying information. This ensures that OTPs change not only over time but also based on the specific server session, preventing real-time interception and reuse attacks while maintaining the dynamic nature of real-time OTP generation
Data Source
AI summary
Reflective factors are used in combination with a, one-time password (OTP) in order to strengthen a system's ability to prevent man in the middle (MITM) phishing attacks. These reflective factors may include information such as URL information, HTTPS, a server's certificate, a session key, or transaction information. These reflective factors help to ensure that a client that wishes to access a server is the legitimate client, because even if a phisher (including a phisher attacking the legitimate client in real time) records identifying information from the legitimate client, it cannot replicate the reflective information to authenticate itself with the server.