Two-Level Authentication System for Secure Web Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in providing secure identity verification and transaction protection, particularly against man-in-the-middle and man-in-the-browser attacks, and are costly due to the need for centralized authentication servers and complex token verification processes.
Innovation Solution
A two-level security verification system using a trusted security module with a proxy service and global unique identifier, which authenticates user access through a client computing device, eliminating the need for a third-party server and enhancing authentication security by using a trusted proxy web server to validate credentials and protect transactions from insecure environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional one-factor authentication (username and password) is used, then the system is easy to operate, but it is not secure enough against attacks such as MITM, MITB, and keystroke logging
Solution Approach 1:
The patent introduces a trusted security module as an intermediary component between the user and the authentication system. This module generates one-time passwords locally on the user's device, acting as a mediator that eliminates the need for centralized token verification servers while enhancing security against MITM and MITB attacks. The intermediary approach allows the system to maintain simplicity while significantly improving authentication reliability.
2Reliability
If two-factor authentication with centralized authentication server is implemented, then authentication security is improved, but the system becomes costly and faces scalability issues
Solution Approach 1:
The patent extracts the token verification function from the centralized authentication server and relocates it to the user's local device through the trusted security module. This extraction eliminates the need for complex server-side token verification infrastructure, reducing system architecture complexity and costs while maintaining strong authentication security. The local verification approach also improves scalability by distributing the verification load.
Solution Approach 2:
The trusted security module enables self-service authentication by generating and verifying one-time passwords locally on the user's device without requiring external server intervention for token verification. This self-service mechanism simplifies the system architecture by eliminating the need for centralized token management while maintaining security, directly addressing the contradiction between security and complexity.
3Reliability
If physical tokens and security codes are verified at a remote authentication server, then two-factor authentication is achieved, but separate protocols are required and scalability issues arise
Solution Approach 1:
The patent merges the verification of physical tokens and security codes into a single integrated process that occurs locally on the user's device through the trusted security module. Instead of requiring separate verification protocols at a remote server, the system combines both verification steps into one unified local operation, reducing protocol complexity while maintaining authentication verification reliability.
Data Source
AI summary
A two-level authentication system is described supporting two-factor authentication that offers efficient protection for secure on-line web transactions. It includes a global unique identity (UID) provided either by an institute-issued/personal trusted device, or based on client computing platform hardware attributes, and generated using institution authorized private software, institution-authorized authentication proxy software, and an institution-generated credential code which is pre-stored in the token and only accessible by the institute-authorized authentication proxy software. The institution-authorized authentication proxy software uses the user's PIN and the trusted device's UID as input and verifies the user and device identities through institution-generated credential code which was pre-stored in the trusted device. Authentication is performed in two levels: the first authenticates the user and the trusted device locally; and the second authenticates the user remotely at the institution-owned authentication server. Various embodiments add extra levels of security, including one-time-password management.