System and Method of Mobile Anti-Pharming and Improving Two Factor Usage

• US 20070174630A1
• Filed: 02/18/2006
• Published: 07/26/2007
• Est. Priority Date: 02/21/2005
• Status: Abandoned Application

• Current Assignee: MetaSwarm, Inc.
• Original Assignee: Marvin Shannon, Wesley Boudville
• Inventors: Boudville, Wesley, Shannon, Marvin
• Application Number:
  US11/307,732
• Publication Number:
  US 20070174630A1
• Time in Patent Office: Days
• US Class Current: 713/183
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 20/108 Remote banking, e.g. home banking
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A variant of phishing involves subverting an Internet access point, often used for mobile computing. Malware can route user requests for bank websites into a phisher'"'"'s private network, with fake bank websites (pharming). The user can have a “mobile password” at the bank. When she connects from an access point, she sends a hash, found from the password, starting at some position in it. The bank returns a hash, found from the same password, starting at another position in it. Each can verify the other. We protect both from a man in the middle attack. By hashing a web page and the mobile password, and inserting the hash into the page that is sent, the recipient can verify that the page is untampered. We use an anonymizer, external to the access point. A user pre-establishes a password with the anonymizer. At the access point, she and the anonymizer use a zero knowledge protocol to verify each other, based on the password. Then, the password encrypts communication between them. From the anonymizer, she logins elsewhere. The anonymizer is our man in the middle, to defeat a man in the middle attack. W extend earlier antiphishing methods, to attack pharms for non-existent banks, or that are unauthorized websites for actual companies. We show how to use a plug-in to let websites share several two factor implementations. This reduces the cost and inconvenience to consumers, who might otherwise have to carry and use a different two factor gadget, for each of their bank accounts or other corporate websites that mandates the usage of two factor authentication. By expanding the scope of two factor usage, we improve the security of e-commerce, without having to use a public key infrastructure.

Claims

1. A method of a user and a website (“

bank”

), of which she is a member, establishing a password (“

mobile password”

) to be used when she connects to it from an access point;

where she hashes the password, starting at some bit position (“

i”

) in it, and sends the (hash, i) along with related data like her username to the bank.

2. A method of using claim 1, where if the information is verified by the bank, it replies with (hash, j), where this hash is made from the mobile password, starting at position j;

and where the user verifies the reply.

3. A method of using claim 1, where the user sends (hash, i, j) and asks the bank to reply with the hash made from position j.

4. A method of using claim 1, where the user hashes some combination of a web page that is to be sent to the bank, along with her mobile password, and adds this hash to the page, before transmission;

and where the bank extracts the hash and verifies it against the page and mobile password, to ensure that the page was unchanged in transmission.

5. A method of using claim 4, where the roles of the user and bank are interchanged.

6. A method of using claim 2, where the “

bank”

is now another website (“

anonymizer”

), and where if the user and anonymizer successfully verify, then the mobile password is used to establish a direct encrypted channel;

from which the user logs in to other websites using this channel and the anonymizer.

7. A method of a website (“

Broker”

) publishing a list of other companies that issue two factor gadgets (Two Factor List or TFL), whose passwords it is willing to recognise.

8. A method of using claim 7, where the Broker publishes its TFL to an Aggregator (“

Agg”

), which makes it available to its plug-ins.

9. A method of using claim 8, where a user with an account at the Broker and at a bank in the TFL obtains a token from the bank, after logging into the bank using a two factor gadget;

she then submits the token and other ancillary data to the Broker, who can verify the token with the bank.

10. A method of using claim 9, where the user pre-establishes a common set of data with the Broker and bank, to enhance the security of the validation.