Spinning Authentication Matrix Against Keystroke and Screen Capture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user authentication methods are vulnerable to malicious attacks, such as keystroke logging and screen capturing malware, which can compromise authentication credentials.
Innovation Solution
A system using an authentication matrix with spurious and authentication blocks, combined with a block selection sequence and matrix spinning operations, to enhance security by making it difficult for malicious users to obtain authentication information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (passwords, OTPs, biometrics) are used, then authentication process is simple and user-friendly, but authentication security is vulnerable to malware attacks
Solution Approach 1:
The authentication matrix is divided into multiple blocks arranged in rows and columns. Each block contains authentication data that is segmented and distributed across the matrix. The user's authentication credentials are split into multiple components (row selection, column selection, block sequence) rather than being a single集中的 credential, making it difficult for malware to capture the complete authentication information.
Solution Approach 2:
The authentication system transitions from traditional linear/password-based authentication to a two-dimensional matrix structure. The user navigates through rows and columns to select authentication blocks, adding spatial dimensions to the authentication process. This dimensional transformation complicates malware's ability to intercept and replicate authentication credentials.
2Reliability
If an authentication matrix with multiple blocks is used, then authentication security is improved, but user operation complexity increases
Solution Approach 1:
The authentication matrix and block selection sequence are pre-configured and stored on the user's device before authentication is needed. During the authentication process, the user simply follows the pre-determined sequence to select blocks, rather than having to make complex decisions in real-time. This preliminary preparation reduces the cognitive load and operational complexity during actual authentication.
Solution Approach 2:
The authentication system uses visual copies or representations of the matrix blocks displayed on the user interface. Instead of requiring users to manually input complex authentication data, the system presents visual block selections that the user can easily identify and select through simple taps or clicks, simplifying the interaction while maintaining security.
3Reliability
If spurious blocks are mixed with authentication blocks, then malware cannot distinguish valid authentication information, but system complexity increases
Solution Approach 1:
Spurious blocks act as intermediaries or decoys within the authentication matrix. These blocks appear visually similar to valid authentication blocks but contain no sensitive information. When malware attempts to capture or analyze the matrix, it cannot distinguish which blocks are genuine authentication elements and which are spurious, thereby protecting the actual authentication credentials from being compromised.
Data Source
AI summary
A method includes receiving hashes of a static password and a lot-one authentication string from a user device of a user. After an initial validation, a first authentication matrix (AM) is generated. A block selection process is performed to select spurious and authentication blocks. While performing the block selection process, the first AM is replaced by a second AM, such that a first authentication block is selected from the first AM based on a first lot-two authentication string and a second authentication block is selected from the second AM based on a second lot-two authentication string. A dynamic password is generated by combining the static password, the lot-one authentication string, and the authentication blocks. A hash of the dynamic password is generated. In response to determining that the hash of the dynamic password matches a hash of a dynamic password stored in a user profile, the user is authenticated.