Method for providing out-of-band authentication over a mobile network and computer program product implementing the method

Abstract

A method for providing out-of-band authentication over a mobile network and a computer program product for implementing the method are disclosed. The method includes: a) generating a pair of public and private keys by an authentication unit in a mobile communication device and sending the public key and an identity number to a first server through a first mobile communication channel by the mobile communication device; b) receiving, by the mobile communication device, an information sent from a second server through a second mobile communication channel via the first server, the information including a random secret and an operational information, wherein the information is encrypted by the public key provided by the first server if the second server transmits the identity number together with the information; c) decrypting, by the authentication unit, the information with the private key; and d) displaying, by the mobile communication device, the operational information and the random secret for user use.

Description

Technical Field

[0001] This invention relates to an authentication technology, and more particularly to a method for providing out-of-band authentication over a mobile network and a computer program product for implementing the method. Background Technology

[0002] One-time password (OTP) is a security technology used for identity authentication. It is a two-factor authentication (2FA) system and the most widely used out-of-band authentication method for Short Message Service (SMS), leveraging the convenience of existing mobile infrastructure. OTP aims to prevent password theft and replay attacks. OTP operates by generating a different password each time a user logs in or transacts on the primary communication channel. This password has a short validity period, expiring after one use. This requires an additional, independent communication channel for auxiliary authentication; the two channels typically involve the user's internet connection's wireless network and the mobile phone's wireless network.

[0003] OTP, as the most widely used identity authentication method, has a wide range of applications. It can be used for identity login authentication, online banking and payments, e-commerce platform or enterprise system login, social media and email access, and even the operation of cryptocurrency exchanges. While OTP effectively improves security, it is not entirely foolproof and still has some hidden dangers. OTP has the following security vulnerabilities: SIM card swapping, SS7 technology flaws, abuse of SMS verification services to create fake accounts, and online identity theft. Furthermore, SMS verification codes (SMS OTP) offer a poor user experience, testing users' memory and being vulnerable to malicious social engineering attacks. By the end of July 2016, the National Institute of Standards and Technology (NIST) began to discontinue the use of SMS-based out-of-band authentication. This was explicitly stated in NIST Special Publication 800-63B, Draft "Guidelines for Digital Authentication."

[0004] To address the security vulnerabilities of traditional SMS verification codes, improve user experience, and provide support for various application scenarios, this invention was proposed. Summary of the Invention

[0005] This paragraph extracts and summarizes certain features of the invention. Other features will be provided in subsequent paragraphs. Its purpose is to cover various modifications and similar arrangements within the spirit and scope of the appended claims.

[0006] The purpose of this invention is to provide a method for providing out-of-band authentication via a mobile network and a computer program product for implementing the method.

[0007] To address the aforementioned problems, this invention provides a method for providing out-of-band authentication via a mobile network. The method includes the steps of: a) generating a public key and private key pair by an authentication unit in a mobile communication device, and establishing a Personal Identification Number by the authentication unit. a) The mobile communication device sends the public key and an identity number to a first server via a first mobile communication channel; b) The mobile communication device receives information sent from a second server via a second mobile communication channel, passing through the first server, the information containing a random secret and operational information. If the second server transmits the identity number along with the information, the information is encrypted with the public key provided by the first server; d) The authentication unit decrypts the information with the private key; e) The mobile communication device displays the operational information to request a verification code for the operational information from a user; f) The mobile communication device receives the verification code; g) The authentication unit verifies whether the verification code is the same as the identity verification code, and signs the random secret with the private key if they are the same; and h) The mobile communication device sends the signed random secret to the first server via the first mobile communication channel.

[0008] Preferably, the authentication unit may be a Subscriber Identity Module (SIM) card in the mobile communication device, a thin-film SIM attached to the SIM card in the mobile communication device, or a central processing unit (CPU) of the mobile communication device that executes an embedded SIM (eSIM) or a program.

[0009] According to the present invention, the first mobile communication channel may be an over-the-air (OTA) technology communication channel implemented by a Bearer Independent Protocol (BIP).

[0010] According to the present invention, the second mobile communication channel can be an over-the-air communication channel implemented by Short Message Service (SMS-PP) technology.

[0011] According to the present invention, when the authentication unit is a central processing unit of the mobile communication device executing a program, both the first mobile communication channel and the second mobile communication channel are Open Mobile Alliance (OMA) or Google Carrier Services (GCS) channels. The mobile communication device accesses the first mobile communication channel and the second mobile communication channel through a non-Wi-Fi access point.

[0012] Ideally, the random secret can be a randomly generated token, a time-based token, a counter-based token, a transaction identifier, or a hashed transaction identifier.

[0013] Ideally, the identification number can be an International Mobile Subscriber Identity (IMSI) connected to a cellular mobile network, a Mobile Subscriber Integrated Services Digital Network (MSISDN) number connected to a cellular mobile network, or a wallet address connected to a blockchain network.

[0014] Ideally, this operational information could be verification information or transaction information.

[0015] The present invention also provides another method for providing out-of-band authentication via a mobile network. The method includes the steps of: a) generating a public key and a private key pair by an authentication unit in a mobile communication device, and sending the public key and an identity number to a first server via a first mobile communication channel; b) receiving, by the mobile communication device, information transmitted from a second server via a second mobile communication channel and passing through the first server, the information containing a random secret and operational information, wherein if the second server transmits the identity number along with the information, the information is encrypted with the public key provided by the first server; c) decrypting the information by the authentication unit using the private key; and d) displaying the operational information and the random secret by the mobile communication device for user use.

[0016] Ideally, the authentication unit may be a SIM card in the mobile communication device, a thin-film SIM attached to the SIM card in the mobile communication device, or a central processing unit of the mobile communication device that executes an eSIM or a program.

[0017] According to the present invention, the first mobile communication channel may be an over-the-air technology communication pipeline, implemented by a carrier independent protocol.

[0018] According to the present invention, the second mobile communication channel can be an over-the-air communication channel implemented using point-to-point SMS service technology.

[0019] According to the present invention, when the authentication unit is a central processing unit of the mobile communication device executing a program, both the first mobile communication channel and the second mobile communication channel are Open Mobile Federation or Google Telecom service channels. The mobile communication device accesses the first mobile communication channel and the second mobile communication channel through a non-Wi-Fi access point.

[0020] Ideally, the random secret can be a randomly generated token, a time-based token, a counter-based token, a transaction identifier, or a hashed transaction identifier.

[0021] Ideally, the identification number could be an International Mobile Subscriber Identity (IMSI) connected to a cellular mobile network, a Mobile Subscriber Integration Service (MSI) number connected to a cellular mobile network, or a wallet address connected to a blockchain network.

[0022] Ideally, this operational information could be verification information or transaction information.

[0023] This invention also provides a computer program product. When this computer program product is loaded into and executed in an authentication unit of a mobile communication device, the methods described above can be performed.

[0024] This invention addresses the security vulnerabilities of traditional OTP systems because the data structure provided in this embodiment avoids issues such as SIM card swapping, SS7 technology flaws, SMS phone verification services, and network identity theft. Since only one authentication code needs to be remembered, and users no longer need to enter a time-based number for out-of-band authentication each time, the user experience is improved. As shown in the following embodiments, various application scenarios can be implemented to solve the aforementioned problems. Attached Figure Description

[0025] Figure 1 This is a flowchart of a method for providing out-of-band authentication via a mobile network according to a first embodiment of the present invention.

[0026] Figure 2 This is a schematic diagram illustrating the application scenario of the first embodiment.

[0027] Figure 3 This is a flowchart of another method for providing out-of-band authentication via a mobile network according to a second embodiment of the present invention.

[0028] Figure 4 This is a schematic diagram illustrating the application scenario of the second embodiment.

[0029] Explanation of reference numerals in the attached diagram: 1-Mobile phone; 2-First server; 3-Second server; 4-Tablet computer; 5-Laptop computer; 10-First mobile communication channel; 11-SIM card; 12-Thin film SIM; 13-SIM card; 20-Second mobile communication channel; IN1~IN6-Identity number; PU1~PU6-Public key; PR1-Private key; PR2-Private key. Detailed Implementation

[0030] The present invention will be described in more detail with reference to the following embodiments.

[0031] Please see Figure 1 and Figure 2 . Figure 1 This is a flowchart of a method for providing out-of-band authentication via a mobile network (hereinafter referred to as "this method") according to a first embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the application scenario of the first embodiment. In this embodiment, a user of mobile phone 1 conducts a transaction, for example, purchasing an NFT on a platform provided by a second server 3 on the Internet. The second server 3 needs to identify the user and perform out-of-band authentication via the mobile network. According to the present invention, this method is implemented by a computer program product, which will be described below.

[0032] The first step of this method is to generate a public key and a private key pair by an authentication unit in a mobile communication device, and to establish a Personal Identification Number (PIN) code by the authentication unit (S01). The aforementioned mobile communication device refers to a mobile phone 1; generally, it could also be other devices that provide video and audio communication via a Subscriber Identity Module (SIM), such as a tablet computer. The authentication unit is an electronic component installed or equipped in the mobile communication device that provides SIM card functionality or acts as a SIM card. Therefore, specific examples of the authentication unit can be, but are not limited to, the SIM card in the mobile communication device, a thin-film SIM attached to the SIM card in the mobile communication device (e.g., the laminated card component disclosed in US20080076474A1), or a central processing unit (CPU) of the mobile communication device executing an embedded SIM (eSIM) or a program. Here, the eSIM is directly embedded into the mobile communication device in software form, installed on the eUICC chip, which is the CPU mentioned above. The aforementioned computer program product, when loaded into and executed by the authentication unit of the mobile communication device, can perform this method. The computer program product can be run by a SIM card, a thin-film SIM, or a CPU. Therefore, the computer program product is a program run by the CPU. In this embodiment, the authentication unit is a thin-film SIM 12, attached to the SIM card 11 of the mobile phone 1.

[0033] The authentication unit (thin-film SIM 12) is equipped with the computer program product, enabling the computer program product to operate through the thin-film SIM 12 to generate a public key PU1 and a private key PR1. The generation method is not limited to this invention. For example, the generation method could be the Rivest-Shamir-Adleman (RSA) algorithm, a digital signature algorithm, or an elliptic curve cryptography algorithm. An authentication code is created by the authentication unit. More precisely, the authentication code is input into the authentication unit via a mobile communication device, and the authentication unit then creates the same content for use in subsequent steps of this method. The authentication code can be several numbers, letters, or a combination thereof.

[0034] The second step of this method involves the mobile communication device (mobile phone 1) sending a public key PU1 and an identity number IN1 to a first server 2 (S02) via a first mobile communication channel 10. For example, the identity number IN1 can be an International Mobile Subscriber Identity (IMSI) connected to a cellular mobile network, a Mobile Subscriber Integrated Services Digital Network (MSISDN) number connected to a cellular mobile network, or even a wallet address connected to a blockchain network. The first server 2 stores and provides public keys, such as PU1 to PU6, and corresponding identity numbers, such as IN1 to IN6, for out-of-band authentication by different mobile communication devices. According to this invention, the first mobile communication channel 10 is an over-the-air (OTA) communication channel. Specifically, the OTA communication channel is implemented using a Bearer Independent Protocol (BIP). The first mobile communication channel 10 may be another channel under certain conditions. When the authentication unit is the central processing unit of a mobile communication device executing a program, the first mobile communication channel 10 can be an Open Mobile Alliance (OMA) or Google Carrier Services (GCS) channel supported by that central processing unit. It is important to note that the first mobile communication channel 10 should be accessed by the mobile communication device through a non-Wi-Fi access point. That is, the first mobile communication channel 10 should be accessed directly through a communication base station.

[0035] The third step of this method involves the mobile communication device (mobile phone 1) receiving information sent from a second server 3 via a second mobile communication channel 20, passing through a first server 2. This information contains a random secret and operational information. If the second server 3 transmits the identity number along with the information, the information is encrypted with the public key provided by the first server 2 (S03). Many mobile communication devices may contact the second server 3. As mentioned earlier, the second server 3 operates the platform and performs out-of-band authentication. It must inform the second server 3 which mobile communication device needs to perform out-of-band authentication; the identity number identifies that mobile communication device. Simultaneously, the second server 3 also sends this information along with the identity number. After informing the mobile phone 1 user of the out-of-band authentication request regarding the out-of-band authentication and operational information, the random secret provides feedback from the mobile communication device. In practice, the random secret can be a token randomly generated by the second server 3, a time-based token (expiring after a set time), a counter-based token (expiring after multiple calls), a transaction identifier (for a specified transaction), or a hashed transaction identifier. Operational information can be verification information used to inform users of out-of-band authentication details, or transaction information informing users of a transaction. When this information is provided to the first server 2, it is unencrypted plaintext. Before being sent by the first server 2, this information is encrypted using the public key PU1 provided by the first server 2.

[0036] Mobile phone 1 receives the encrypted message through a second mobile communication channel 20 instead of the first mobile communication channel 10. According to the invention, the second mobile communication channel 20 is an over-the-air communication channel implemented using Short Message Service (SMS-PP). When the authentication unit is the central processing unit of the mobile communication device executing a program, the second mobile communication channel 20 can be an Open Mobile Federation (OMF) or Google Telecom service channel supported by that central processing unit. However, in this case, both the first mobile communication channel 10 and the second mobile communication channel 20 should simultaneously be OMF or Google Telecom service channels. Similarly, the second mobile communication channel 20 should be accessed by mobile phone 1 through a non-Wi-Fi access point.

[0037] The fourth step of this method is for the authentication unit to decrypt the information using the private key PR1 (S04). That is, the thin-film SIM 12 uses the private key PR1 to decrypt the information and obtain the aforementioned random secrets and operational information.

[0038] The fifth step of this method is for the mobile communication device (mobile phone 1) to display the operation information to request a verification code from a user (S05). According to the present invention, the operation information includes explanatory text that requires the user of mobile phone 1 to enter the verification code. The verification code is used to check whether it is the same as the identity verification code.

[0039] The sixth step of this method is for the mobile communication device (mobile phone 1) to receive the verification code (S06). The seventh step of this method is for the authentication unit (film SIM 12) to verify whether the verification code is the same as the identity verification code, and if they are the same, to sign the random secret with the private key PR1 (S07). This step is that when the verification code entered by the user is the same as the identity verification code he / she sets, the random secret is digitally signed for further use. This is similar to traditional out-of-band authentication, which requires the user to enter an identity verification code that has been notified via SMS to confirm that the same person is handling the identity verification code. This method, however, requires the user to enter the same identity verification code that he / she sets for authentication.

[0040] The final step of this method is for the mobile communication device (mobile phone 1) to send a signed random secret to the first server 2 via the first mobile communication channel 10 (S08). The signed random secret serves as proof of verification and will be transmitted from the first server 2 to the second server 3 for further use.

[0041] According to the present invention, the verification process can be performed without the need for an authentication unit, and the verification result does not need to be sent back to the first / second server. The second embodiment below illustrates another method for providing out-of-band authentication via a mobile network.

[0042] Please see Figure 3 and Figure 4 . Figure 3 This is a flowchart of another method for providing out-of-band authentication via a mobile network according to a second embodiment of the present invention (hereinafter referred to as the "method"). Figure 4 This is a schematic diagram illustrating the application scenario of the second embodiment. In this embodiment, the user of tablet computer 4 conducts transactions via the Internet on a platform provided by the second server 3. The second server 3 needs to verify the user's identity and perform out-of-band authentication via a mobile network. The method in the second embodiment is also implemented by a computer program product. This computer program product is defined as described in the first embodiment and will not be repeated here. To reduce the description, Figure 4 and Figure 2 The same symbol represents the same item and has similar functions.

[0043] The first step of this method involves generating a public key PU2 and a private key PR2 by an authentication unit in a mobile communication device, and then sending the public key and an identity number to a first server 2 via a first mobile communication channel 10 (S11). The authentication unit can be a SIM card in the mobile communication device, a thin-film SIM attached to the SIM card, or a central processing unit of the mobile communication device executing an eSIM or a program. In this embodiment, the mobile communication device is a tablet computer 4, and the authentication unit is the SIM card 13 in the tablet computer 4. The method for generating the public key PU2 and private key PR2 is also unrestricted. The type of identity number is the same as in the first embodiment, and can be an International Mobile Subscriber Identity (IMSI) connected to a cellular mobile network, a Mobile Subscriber Integration Service (MSIS) number connected to a cellular mobile network, or a wallet address connected to a blockchain network. The first mobile communication channel 10 is an over-the-air communication channel implemented by a carrier independent protocol.

[0044] The second step of this method involves the mobile communication device (tablet computer 4) receiving information transmitted from a second server 3 via a second mobile communication channel 20, passing through a first server 2. This information contains a random secret and operational information. If the second server 3 transmits the identity number along with the information, the information is encrypted using the public key PU2 provided by the first server 2 (S12). The second mobile communication channel 20 is also an over-the-air communication channel implemented using peer-to-peer SMS technology. It should be noted that when the authentication unit is the central processing unit of the tablet computer 4 executing a program, both the first mobile communication channel 10 and the second mobile communication channel 20 should be Open Mobile Federation or Google Telecom service channels. The first mobile communication channel 10 and the second mobile communication channel 20 are also accessed by the tablet computer 4 through a non-Wi-Fi access point, as described in the first embodiment. The random secret can be a randomly generated token, a time-based token, a counter-based token, a transaction identifier, or a hashed transaction identifier. The operational information can be verification information or transaction information.

[0045] The third step of this method is for the authentication unit (SIM card 13) to decrypt the information using the private key PR2 (S13). This step is the same as step S04 in the first embodiment.

[0046] The final step of this method is for the mobile communication device (tablet computer 4) to display the operational information and the random secret for the user's use (S14). In addition to the operational information, the random secret also needs to be displayed to the user for further verification later. For example, the random secret is entered into a shopping website operated by a second server 3 on a laptop computer 5 for verification purposes. The random secret will not be returned to the authentication unit.

[0047] While the present invention has been provided above with reference to embodiments, it is not intended to limit the invention. Any person skilled in the art can make modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for providing out-of-band authentication via a mobile network, characterized in that, Includes the following steps: a) A public key and a private key pair are generated by an authentication unit in a mobile communication device, and a personal identification code is established by the authentication unit; b) The mobile communication device sends the public key and an identity number to a first server via a first mobile communication channel; c) The mobile communication device receives information transmitted from a second server through a second mobile communication channel and passing through the first server. The information contains a random secret and operational information. If the second server transmits the identity number along with the information, the information is encrypted with the public key provided by the first server. d) The authentication unit decrypts the information using the private key; e) The mobile communication device displays the operational information to request a verification code for the operational information from a user; f) The verification code is received by the mobile communication device; g) The authentication unit verifies whether the verification code is the same as the identity confirmation code, and if they are the same, signs the random secret using the private key; and h) The mobile communication device sends a signed random secret to the first server through the first mobile communication channel.

2. The method as described in claim 1, characterized in that, The authentication unit is the SIM card in the mobile communication device, a thin-film SIM attached to the SIM card in the mobile communication device, or a central processing unit of the mobile communication device that executes an embedded SIM or a program.

3. The method as described in claim 1, characterized in that, This first mobile communication channel is an airborne technical communication pipeline, implemented by an independent protocol.

4. The method as described in claim 1, characterized in that, The second mobile communication channel is an airborne technical communication channel, implemented using point-to-point SMS service technology.

5. The method as described in claim 1, characterized in that, When the authentication unit is a central processing unit of the mobile communication device executing a program, both the first mobile communication channel and the second mobile communication channel are Open Mobile Alliance or Google Telecom Service channels.

6. The method as described in claim 1, characterized in that, The mobile communication device accesses the first mobile communication channel and the second mobile communication channel through a non-Wi-Fi access point.

7. The method as described in claim 1, characterized in that, The random secret is a randomly generated token, a time-based token, a counter-based token, a transaction identifier, or a hashed transaction identifier.

8. The method as described in claim 1, characterized in that, This identification number is an International Mobile Subscriber Identity (IMSI) connected to a cellular mobile network, a Mobile Subscriber Integration Service (MSI) number connected to a cellular mobile network, or a wallet address connected to a blockchain network.

9. The method as described in claim 1, characterized in that, This operational information may be verification information or transaction information.

10. A method for providing out-of-band authentication via a mobile network, characterized in that, Includes the following steps: a) A public key and a private key are generated by an authentication unit in a mobile communication device, and the mobile communication device sends the public key and an identity number to a first server through a first mobile communication channel; b) The mobile communication device receives information transmitted from a second server through a second mobile communication channel and passing through the first server. The information contains a random secret and operational information. If the second server transmits the identity number along with the information, the information is encrypted with the public key provided by the first server. c) The authentication unit decrypts the information using the private key; and d) The mobile communication device displays the operational information and the random confidential information for the user's use.

11. The method as described in claim 10, characterized in that, The authentication unit is the SIM card in the mobile communication device, a thin-film SIM attached to the SIM card in the mobile communication device, or a central processing unit of the mobile communication device that executes an embedded SIM or a program.

12. The method as described in claim 10, characterized in that, This first mobile communication channel is an airborne technical communication pipeline, implemented by an independent protocol.

13. The method as described in claim 10, characterized in that, The second mobile communication channel is an airborne technical communication channel, implemented using point-to-point SMS service technology.

14. The method as described in claim 10, characterized in that, When the authentication unit is a central processing unit of the mobile communication device executing a program, both the first mobile communication channel and the second mobile communication channel are Open Mobile Alliance or Google Telecom Service channels.

15. The method as described in claim 10, characterized in that, The mobile communication device accesses the first mobile communication channel and the second mobile communication channel through a non-Wi-Fi access point.

16. The method as described in claim 10, characterized in that, The random secret is a randomly generated token, a time-based token, a counter-based token, a transaction identifier, or a hashed transaction identifier.

17. The method as described in claim 10, characterized in that, This identification number is an International Mobile Subscriber Identity (IMSI) connected to a cellular mobile network, a Mobile Subscriber Integration Service (MSI) number connected to a cellular mobile network, or a wallet address connected to a blockchain network.

18. The method as described in claim 10, characterized in that, This operational information may be verification information or transaction information.

19. A computer program product, characterized in that, When loaded into and executed in an authentication unit of a mobile communication device, the method of any one of claims 1-18 is performed.

Images