Virtual Keyboard Password Protection via Separate Device
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password protection methods are inadequate against identity theft and password hacking, as strong passwords and frequent changes do not prevent theft from keyboard hooking, key logging, or screen recording malware, and two-factor authentication can be compromised by rogue mobile applications or weak GSM networks.
Innovation Solution
A system that separates password input from the rendering of a keyboard by using a virtual keyboard on a separate computing device, where a blank keyboard on the user's computer is referenced against a randomly generated alphanumeric keyboard on another device, preventing malicious software from capturing the actual password.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a virtual keyboard is used on the user's computer to enter passwords, then password entry convenience is improved, but the password can still be stolen by keyboard hooking malware, key logging malware, or screen recording malware
Solution Approach 1:
The patent introduces a mobile computing device as an intermediary that generates and displays a reference keyboard layout. The user enters passwords on the client computer's virtual keyboard by referencing the mobile device's keyboard, creating a trusted mediation layer that prevents malware on the client computer from capturing the actual password characters.
Solution Approach 2:
The patent segments the password entry process into two separate components: the client computer handles only the input positioning (which keys to press) while the mobile computing device handles the actual character display and reference. This segmentation ensures that even if the client computer is compromised, the actual password characters remain protected on the mobile device.
2Reliability
If two-factor authentication via SMS is used to protect passwords, then authentication security is improved, but the solution can be compromised by rogue mobile applications or weak GSM networks
Solution Approach 1:
The mobile computing device serves as a trusted intermediary that generates cryptographic key pairs and stores private keys locally. This intermediary approach eliminates reliance on vulnerable SMS channels or GSM networks, as the security mechanism operates through local cryptographic operations and secure key storage on the mobile device rather than through vulnerable communication channels.
3Reliability
If authenticator-based solutions like Google Authenticator are used, then verification security is improved, but the verification code remains valid for at least one minute allowing hackers to use stolen codes
Solution Approach 1:
The patent uses cryptographic key pairs where the private key is stored securely on the mobile device and the public key is shared with the server. This copying mechanism allows for immediate validation of authentication requests without time-based delays, as the server can instantly verify the authenticity of each authentication attempt using the public key, eliminating the one-minute validity window that exists in traditional authenticator solutions.
Data Source
AI summary
A virtual keyboard rendered on a separate computing device is independent of the user's computer. A virtual keyboard displayed on the user's computer screen is blank without any alphanumeric characters. Another virtual keyboard displayed on the user's independent computing device has a randomly generated layout of alphanumeric characters on a keypad. The user enters a password by pressing the blank keys of the blank keyboard on his computer screen with reference to the other virtual keyboard. The position sequence of these entered keys is sent to an application on a remote server computer. The remote server computer shares a virtual keyboard having the randomly generated layout of characters with the independent computing device via an online or off-line technique. When online, an encoded image of the encrypted layout is sent to the client computer and displayed for scanning by the device. When off-line, both the application and the device generate the same random key sequence by using the same pseudo random number generator and the same seed value.