Trusted Messaging Path for Anti-Replay Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, such as passwords and biometrics, are vulnerable to attacks like man-in-the-middle and man-in-the-machine, and lack robust security measures against unauthorized access and data tampering, particularly in financial services.
Innovation Solution
Implementing a trusted path infrastructure with a data-collection module that generates and transmits secured objects with anti-replay, anti-tamper, and integrity headers, using cryptographic key storage and message-level security to protect against unauthorized information disclosure and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional authentication methods (passwords, biometrics) are used, then ease of operation is improved, but security against man-in-the-middle and man-in-the-machine attacks deteriorates
Solution Approach 1:
The patent introduces a trusted path infrastructure as an intermediary between the authentication credential and the server. This trusted path includes a data-collection module that establishes a secure communication channel, preventing man-in-the-middle and man-in-the-machine attacks by mediating all authentication data transmission through verified security protocols
Solution Approach 2:
The authentication system is segmented into multiple components: the authentication credential (biometric or password), the data-collection module, the trusted path infrastructure, and the server. This segmentation allows each component to perform its specific security function, with the data-collection module handling secure data collection and the trusted path handling secure transmission, thereby improving overall security while maintaining ease of operation
2Reliability
If multi-factor authentication is implemented, then security against credential theft is improved, but device complexity increases
Solution Approach 1:
The patent merges multiple authentication factors (biometric data, password, device identification) into a unified authentication credential that is processed through a single trusted path infrastructure. The data-collection module consolidates these different credential types and transmits them through one secure channel, reducing the perceived complexity for users while maintaining multi-factor security
3Ease of manufacture
If cookie-based machine identification is used, then ease of implementation is improved, but security against malware attacks deteriorates
Solution Approach 1:
The trusted path infrastructure acts as an intermediary that verifies the authenticity of machine identification data before transmission. Instead of directly using cookies that can be stolen by malware, the system uses the trusted path to verify device identification through secure cryptographic protocols, maintaining ease of implementation while preventing malware attacks
Solution Approach 2:
The system performs preliminary verification of device identification through the trusted path before allowing authentication to proceed. This preliminary action ensures that malware cannot compromise the authentication process by injecting fake device identification data, as the trusted path verifies authenticity in advance
Data Source
AI summary
A system for establishing a trusted path for secure communication between client devices and server devices, such as between an account holder and a financial institution, can provide the core security attributes of confidentiality (of the parties), integrity (of the information), anti-replay (protection against replay fraud) and/or anti-tampering (protection against unauthorized changes to information being exchanged and/or modules that generate and communicate such information). A messaging layer implementation in favor of a transport layer implementation can provide a trusted path. This infrastructure features secure cryptographic key storage, and implementation of a trusted path built using the cryptographic infrastructure. The trusted path protects against unauthorized information disclosure, modification, or replays. These services can effectively protect against Man-in-the-Middle, Man-in-the-Application, and other attacks.