Transaction Security via Dual-Terminal MITB Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing transaction systems are vulnerable to MITB (Man In The Browser) attacks, where a computer virus monitors exchanges between a user and a server, allowing unauthorized transactions due to the lack of effective authentication beyond first and second password inputs.
Innovation Solution
A transaction system that utilizes a second terminal for confirmation of transaction details, where a server generates a notice sent to the second terminal, prompting the user to input confirmation, ensuring that the transaction details match between the first and second terminals before execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If only first and second password inputs are used for authentication, then the ease of operation is improved, but the security against MITB attacks deteriorates
Solution Approach 1:
A third terminal (mobile terminal) is introduced as an intermediary device between the first terminal (PC) and the server. The mobile terminal receives transaction notifications from the server and requires user confirmation before allowing transactions to proceed. This intermediary authentication mechanism prevents MITB attacks by ensuring the user is actually present and aware of the transaction, while maintaining ease of operation through automated notification delivery.
2Reliability
If a second terminal is introduced for transaction confirmation, then the security against MITB attacks is improved, but the device complexity increases
Solution Approach 1:
The mobile terminal utilizes existing cellular network infrastructure and standard SMS/MMS messaging capabilities to deliver transaction notifications and receive user confirmation. The system leverages the phone's inherent communication functions rather than requiring specialized security hardware or complex custom software, thereby improving security while minimizing the increase in device complexity.
Data Source
AI summary
A transaction system, a transaction method, and an information recording medium are disclosed herein. In an example, a system includes a first terminal, a second terminal, and a server. Both the first terminal and the second terminal are assigned to a same user name. When an application is started on the second terminal, the application notifies the server of a notification that the application is running on the second terminal and the application is ready to receive data from the server. The first terminal has a login password input by a user using the first terminal, and sends, to the server, a login request specifying the input login password. When the server has already been notified of the notification from the application and the login password specified in the login request is correct for the same user name, the server successfully authenticates the first terminal.