Speech Data Authentication for MitM Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting Man-in-the-Middle (MitM) and Man-in-the-Browser (MitB) attacks are inadequate as they rely on secondary channels or expensive signing tokens, which can be intercepted or inconvenient, and do not effectively authenticate users without altering structured data.
Innovation Solution
A method and system that processes speech data from client devices to authenticate users by converting it into structured input data, using speech recognition and biometric authentication to determine if the data corresponds to an authorized user, thereby preventing data alteration and injection during transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secondary channels (SMS, phone calls) are used for authentication, then user authentication security is improved, but system cost and complexity increase
Solution Approach 1:
The patent extracts the authentication verification process from secondary channels (SMS, phone calls) and integrates it directly into the primary web browser interface. The authentication code is displayed within the browser page itself, eliminating the need for separate communication channels while maintaining security.
Solution Approach 2:
The patent makes the web browser serve multiple functions: it acts as both the transaction interface and the authentication verification channel. The browser displays both the transaction details and the authentication code, consolidating what were previously separate functions into a single universal platform.
2Reliability
If signing tokens are used for authentication, then transaction security is improved, but device cost and user convenience deteriorate
Solution Approach 1:
The patent implements self-service authentication where the user's existing web browser and internet connection are used to generate and verify authentication codes. No external hardware devices are required - the system uses resources already available to the user, making authentication convenient and accessible.
Solution Approach 2:
Instead of requiring physical signing tokens, the patent creates a digital copy of the authentication mechanism within the browser environment. The authentication code is generated and displayed as text on the screen, replicating the security function of physical tokens in a digital, convenient format.
3Productivity
If structured data is used for transactions, then data processing efficiency is improved, but vulnerability to MitM and MitB attacks increases
Solution Approach 1:
The patent applies preliminary anti-action by displaying the authentication code to the user before the transaction is finalized. This allows the user to verify that the transaction details have not been altered by MitM or MitB attacks, preventing harmful actions before they can take effect.
Solution Approach 2:
The patent implements feedback by providing the authentication code back to the user through the browser interface. This feedback loop allows the user to confirm that the data they see matches the data being processed, creating awareness of potential data alterations while maintaining efficient structured data processing.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of processing input data by a server, the method comprising: receiving speech data from a client device; extracting structured input data from the speech data; determining if the speech data corresponds to an authorised user; and if the speech data corresponds to an authorised user, executing a process based on the extracted structured input data.