Anonymous Client Authentication via Trusted Third-Party OTP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing customer authentication methods for websites fail to ensure complete anonymity and security, particularly when sensitive information is involved, as they often require the website to store customer phone numbers, making them vulnerable to fraud and identity theft.
Innovation Solution
A distributed authentication system involving a trusted third party, where a customer's identity is verified through a secure protocol using a random identifier generated by the third party, ensuring that only a minimal amount of information is shared with the website, preserving customer anonymity and preventing sensitive data from being exposed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the website stores the customer's phone number for authentication, then the authentication process is simplified and direct communication is enabled, but the customer's anonymity and security are compromised
Solution Approach 1:
A trusted third party acts as an intermediary between the customer and the website. The third party holds the customer's phone number and uses it to send authentication codes, while the website only receives a verification result without accessing the phone number. This mediator structure enables authentication functionality while preserving customer anonymity and security.
2Reliability
If the website does not store the customer's phone number, then customer anonymity and security are preserved, but the website cannot send authentication codes directly to the customer
Solution Approach 1:
The trusted third party serves as a mediator that bridges the gap between anonymity requirements and authentication needs. It receives authentication requests from the website, generates and sends codes to the customer via SMS using the stored phone number, and returns verification results to the website. This enables indirect authentication while maintaining customer data protection.
3Adaptability or versatility
If sensitive customer information is stored by the website, then personalized service and communication are enabled, but the risk of fraud and identity theft increases
Solution Approach 1:
The sensitive customer information (phone number, personal data) is extracted from the website's data storage and relocated to the trusted third party. The website retains only minimal necessary information for service delivery, while the third party securely holds sensitive authentication data. This separation reduces the website's exposure to security risks while maintaining service capabilities.
Data Source
Figure 1
Figure 2
AI summary
The only exchanges between the service provider and the trusted third party are the transmission (102) of a request to validate an order placed (100) by a customer with the service provider, and the subsequent transmission (126) by the trusted third party of a confirmation/rejection message for that order, without the service provider having access to the customer's phone number. Authentication is performed entirely by the trusted third party, using a secure protocol where the trusted third party generates (106) an email message with a link to a specific web page where the customer enters (110) their phone number. The trusted third party then generates (114) a random identifier (OTP) which is sent via SMS (116, 118) to the customer's phone. The customer enters the identifier on the web page (120) and submits everything to the trusted third party.In case of concordance (124) the trusted third party sends (126) to the service provider site an order validation message, authorising the continuation of the transaction (130) by the latter.