Secure Site Authentication via Separate Channel Pop-up
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current site and user authentication methods on the web are vulnerable to counterfeit sites and attacks, such as man-in-the-middle and man-in-the-browser attacks, and require users to be proactive or install toolbars, while existing SSL infrastructure is confusing and ineffective.
Innovation Solution
A system that uses a pop-up window communicating with a security server through a separate channel to verify site authenticity, providing visual cues and random images, and generates one-time passwords based on shared secrets between the security server and web sites, eliminating the need for user-specific secrets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SSL infrastructure is used for site authentication, then security is provided, but user verification becomes confusing and complex
Solution Approach 1:
The patent introduces a seal image as an intermediary visual element that mediates between the complex SSL authentication infrastructure and the user. The seal image serves as a simplified, intuitive indicator of site authenticity, translating complex cryptographic verification into a simple visual cue that users can easily understand and trust.
2Ease of operation
If seal images are used for site authentication, then user comfort is improved, but counterfeit seals can be easily copied
Solution Approach 1:
The system implements feedback by having the seal image dynamically respond to user actions and system events. The seal can change appearance based on authentication status, user interactions, or security events, providing continuous verification that the seal remains legitimate and the site remains authenticated, making counterfeiting difficult because the seal's state is tied to real-time system conditions.
3Measurement precision
If toolbars are installed to check site authenticity, then detection accuracy is improved, but device complexity and user burden increase
Solution Approach 1:
The web site itself provides the authentication verification by embedding the seal image directly on its own pages. The site serves its own authentication proof, eliminating the need for external toolbars or third-party verification software. The seal image acts as self-verifying evidence of authenticity that is inherently part of the legitimate site's infrastructure.
4Reliability
If per user secrets are used for one time passwords, then user authentication security is improved, but system complexity and provisioning requirements increase
Solution Approach 1:
The patent makes the shared secret universal by having it stored on the user's device and used to generate one-time passwords for multiple different web sites. Instead of requiring a unique secret for each user-site pair, the same shared secret serves multiple authentication purposes across different relying parties, simplifying provisioning while maintaining security through the cryptographic properties of one-time password generation.
Data Source
AI summary
The present invention provides a new method of site and user authentication. This is achieved by creating a pop-up window on the user's PC that is in communication with a security server, and where this communication channel is separate from the communication between the user's browser and whichever web site they are at. A legitimate web site embeds code in the web page which communicates to the security server from the user's desktop. The security server checks the legitimacy of the web site and then signals both the web page on the user's browser, as well as the pop-up window to which it has a separate channel. The security server also sends a random image to both the pop-up window and the browser. If user authentication is requested by the web site the user is first authenticated by the security server for instance by out of band authentication. Then the security server computes a one time password based on a secret it shares with the web site and sends it to the pop up window. The user copies this one time password into their browser which sends it to the web site, which can re-compute the one time password to authenticate the user.