Shared Secret Token Authentication for Web Spoofing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to web spoofing attacks, where users are tricked into providing sensitive information to fraudulent interfaces, and current solutions rely on user education or software downloads, which are ineffective for all users, especially those using dumb clients like web browsers.
Innovation Solution
A web-based solution that provides a shared secret token, such as images, sounds, or text, to users before they submit credentials, allowing them to authenticate the server's legitimacy and prevent fraudulent interfaces without requiring software downloads or modifying existing browsers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a web-based authentication solution is implemented without software downloads, then ease of operation is improved, but security against spoofing attacks deteriorates
Solution Approach 1:
The patent introduces a shared secret token as an intermediary element that mediates between the user and the server. This token, displayed as visible content (image, sound, or text) on the web page, serves as a trusted intermediary that the user can verify independently. The user compares the visible token with the expected token stored locally, creating a verification mechanism that doesn't require additional software but maintains security against spoofing attacks.
2Reliability
If shared secret tokens are displayed on web pages, then authentication reliability is improved, but device complexity increases
Solution Approach 1:
The patent uses copying by displaying a visible representation (copy) of the shared secret token on the web page. Instead of implementing complex cryptographic protocols or additional authentication software, the system creates a visual copy of the token that the user can see and verify. This copy mechanism simplifies the overall system while maintaining authentication security, as it leverages existing web page display capabilities rather than requiring new complex components.
Data Source
AI summary
Protecting a user against web spoofing in which the user confirms the authenticity of a web page prior to submitting sensitive information such as user credentials (e.g., a login name and password) via the web page. The web page provides the user with an identifiable piece of information representing a shared secret between the user and the server. The user confirms the correctness of the shared secret to ensure the legitimacy of the web page prior to disclosing any sensitive information via the web page.