Contextual Voice OTP Authentication for Man-in-the-Middle Calls

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for verifying user identity in telephone calls are cumbersome, insecure, and prone to man-in-the-middle attacks, which allow fraudsters to exploit vulnerabilities and capture sensitive information.

Innovation Solution

A system that generates a voice-based one-time password (OTP) using contextual information, requiring users to speak the OTP aloud, and authenticates the user based on speaker recognition, liveness detection, and fraud detection features extracted from the audio signal.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional knowledge-based questions are used to authenticate users, then user identity verification can be performed, but the authentication process becomes cumbersome and time-consuming

Engineering Contradiction:

Improveuser identity verificationVSAvoidauthentication time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent replaces the mechanical interaction of typing and answering knowledge-based questions with an acoustic/voice-based authentication system. The user simply speaks a displayed OTP, and the system performs speaker recognition and liveness detection, eliminating the need for complex cognitive verification while reducing authentication time.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system enables self-service authentication by automatically generating OTPs, displaying them on the user's device, and processing the voice response without requiring agent intervention. The liveness detection and speaker recognition occur automatically, making the process both fast and user-independent.

Inventive Principle:

Principle #25Self-service

2Ease of operation

If information is transmitted through the telephone communication channel, then user verification can occur, but the channel becomes vulnerable to spoofing and social engineering attacks

Engineering Contradiction:

Improveverification processVSAvoidspoofing attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary verification layer that separates the authentication process from the vulnerable telephone channel. The OTP is displayed on the user's own device (a trusted intermediary), and the voice-based verification with liveness detection creates an additional layer that cannot be spoofed through traditional social engineering or man-in-the-middle attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary anti-action by implementing liveness detection and speaker recognition before any sensitive information is disclosed. This prevents spoofing attacks by verifying that the person on the call is genuinely the account holder, not an impostor using social engineering techniques.

Inventive Principle:

Principle #9Preliminary anti-action

3Reliability

If mobile applications are used to exchange user information, then authentication security can be improved, but the device complexity and user burden increase

Engineering Contradiction:

Improveauthentication securityVSAvoidmobile application requirements

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent makes the authentication system universal by working across multiple device types and operating systems without requiring a proprietary mobile application. The OTP can be displayed on any device with a display and microphone, making the system accessible to all users regardless of their device ecosystem.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system uses disposable, single-use OTPs that are generated for each authentication attempt and displayed on the user's existing device. This eliminates the need for expensive, permanent mobile application installations while maintaining high security through one-time use credentials.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Data Source

PatentUS20250365282A1One time voice passphrase to protect against man-in-the-middle attack

Publication Date: 2025.11.27 PINDROP SECURITY INC

AI summary

Embodiments described herein provide for automatically authenticating operation requests and end-users who submit operation requests during contact events. A server obtains an operation request for an operation originated at an end-user device. The server generates a voice-based one-time password (OTP) using contextual information associated with the requested operation. The server generates and transmits an OTP prompt having text representing the OTP for display at a user interface of the user device. The server receives a response including an audio signal that contains the recording of the user speaking the OTP text aloud. The server uses the audio signal to authenticate the user and the operation request based on the speaker's voice, the accuracy of the user speaking the OTP, and liveness or fraud detection features extracted from the audio signal or metadata from the user device.