Webpage Access Token Verification Against Dynamic Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication (MFA) methods are insufficient in preventing phishing attacks, particularly dynamic phishing attacks where attackers deceive users into providing credentials or approving authentication requests, allowing unauthorized access to legitimate webpages.
Innovation Solution
A system and method that generates and verifies a token from an authentication server, ensuring its validity and integrity through private-public key pairs, which is required for accessing webpages, preventing unauthorized access by attackers who lack the token and private key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication is implemented, then security against phishing attacks is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary authentication actions by generating a token at the authentication server before the user accesses the webpage. This token is shared between the authentication server, web server, and user agent application in advance, establishing security credentials before the actual webpage access occurs. This preliminary token distribution prevents phishing attacks by ensuring the user agent has verified credentials before interacting with potentially malicious sites.
Solution Approach 2:
The token acts as an intermediary element that mediates between the authentication server, web server, and user agent application. Instead of direct complex authentication protocols between all components, the token serves as a shared intermediary credential that simplifies the authentication flow while maintaining security. The token verifies the user agent's legitimacy to both the authentication and web servers without requiring complex real-time verification protocols.
2Reliability
If token verification is performed by the web server, then unauthorized access is prevented, but processing time increases
Solution Approach 1:
The authentication server performs the complex verification work preliminarily when generating and distributing the token. The token itself contains verified authentication data that the web server can validate quickly without performing complex authentication protocols. This shifts the time-consuming verification work to the preliminary token generation phase rather than during each webpage access request.
Solution Approach 2:
The system creates copies of the verified authentication credential (the token) and distributes it to both the authentication server and the user agent application. Instead of the web server performing complex verification calculations, it simply compares the received token against a copy it received from the authentication server. This copying approach dramatically reduces verification processing time while maintaining security.
Data Source
AI summary
A computer-based system and method for providing a secure access to a webpage, including: obtaining, at an authentication server from a user agent application, a request to open the webpage provided by a web server, together with a username; generating a token by the authentication server; providing, by the authentication server, the token to the user agent application and to the web server; sending, by the user agent application, a request to open the webpage together with the token to the web server; verifying, by the web server, the token obtained from the user agent application against the token obtained from the authentication server; and opening the webpage by the web server upon successful verification.