Validation Component for Phishing-Resistant Password Authentication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Passwords are vulnerable to phishing attacks, where attackers create fake websites that resemble legitimate ones, allowing users to inadvertently enter their passwords, leading to unauthorized access.

Innovation Solution

Implementing a validation code system where a secure component collects the password and validation code, using a function known to both the entity and the user agent, to verify the authenticity of the target of authentication before releasing the password, thereby preventing accidental transmission to incorrect entities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a user enters a password on a web site, then authentication may be granted, but the password may be stolen through phishing attacks

Engineering Contradiction:

Improvepassword securityVSAvoidphishing attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary validation by comparing the requested entity's binding with the expected binding before the password is transmitted. This preliminary check prevents phishing attacks by ensuring the user is on the legitimate site before credentials are entered, rather than relying solely on post-entry verification.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The validation component acts as an intermediary between the user agent and the target entity. It intercepts the authentication process, validates the entity's binding, and only allows password transmission to legitimate entities. This intermediary layer blocks phishing attempts without requiring changes to the underlying authentication protocol.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If a validation component intercepts password entry, then phishing attacks are prevented, but user convenience is reduced

Engineering Contradiction:

Improveauthentication securityVSAvoidpassword entry convenience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The validation component operates automatically in the background without requiring user intervention. It autonomously intercepts authentication requests, validates bindings, and determines whether to allow password transmission. This self-service approach maintains security while minimizing impact on user convenience, as users simply proceed with normal authentication without additional steps.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS8365264B2Protecting password from attack

Publication Date: 2013.01.29 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A password may be provided along with a validation code, which can help prevent the password from being sent to the wrong recipient. When a password is created, a validation code may be created based on (a) the password, and (b) the identity of the target of authentication (TA) to which the password is intended to be sent. When a user is requested to provide a password, validation component intercepts the request and asks the user to enter both the password and validation code. The validation component then re-calculates the validation code based on the entered password and on the TA that is requesting the password. If the re-calculated validation code matches the validation code entered by the user, then the password is released to the user agent that the user uses to communicate with the TA, and the user agent sends the password to the requesting TA.