User Authentication Via Device-Mediated SMS Against SIM Swap Attacks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing two-factor and multi-factor authentication methods, such as SMS-based OTP verification, are vulnerable to security risks like SIM swap attacks and interception of OTP codes, compromising user identity verification in online services.

Innovation Solution

A server-based system that calculates signatures using a shared secret key, verifies mobile-originated SMS messages within a time frame, and performs Home Location Register lookups to authenticate user access attempts, reducing fraud potential.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SMS-based OTP verification is used for two-factor authentication, then user identity verification capability is improved, but security against SIM swap attacks and OTP interception is worsened

Engineering Contradiction:

Improveidentity verification capabilityVSAvoidvulnerability to SIM swap attacks and OTP interception

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary verification process where the system sends a call-to-action message to the user's device, which then automatically generates and sends an SMS back to the system. This intermediary step prevents direct OTP transmission vulnerabilities by using the user's own device as a trusted mediator that proves possession without exposing the OTP to external interception or SIM swap attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

Instead of the traditional flow where the system sends OTP to the user and the user inputs it back, the patent inverts the process: the system provides a call-to-action, the user's device automatically generates the verification code, and sends it back to the system. This reversal eliminates the need for secure OTP transmission channels while maintaining verification integrity.

Inventive Principle:

Principle #13The other way round (Inversion)

2Ease of operation

If traditional OTP transmission methods are used, then authentication process simplicity is improved, but security against man-in-the-middle attacks is worsened

Engineering Contradiction:

Improveauthentication process simplicityVSAvoidvulnerability to man-in-the-middle attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The user's own device acts as a trusted intermediary that generates and transmits the verification code directly to the system through a controlled channel. This eliminates the vulnerability to man-in-the-middle attacks because the code is generated on the user's device rather than being transmitted from the system, making interception ineffective.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The user's device autonomously generates the verification code and sends it to the system without requiring manual OTP input or exposure to external communication channels. This self-service approach maintains simplicity while enhancing security by removing the system from the OTP transmission path.

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If email-based OTP verification is used, then alternative authentication channel is improved, but security against email account compromise is worsened

Engineering Contradiction:

Improveauthentication channel flexibilityVSAvoidsecurity against email account compromise

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies the intermediary principle across all authentication channels. Instead of sending OTP through potentially compromised channels (SMS, email), the system provides a call-to-action that triggers the user's device to generate and send the verification code through a secure, device-controlled channel, eliminating channel-specific vulnerabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical OTP transmission system (relying on secure communication channels) with an automated device-based system where the user's device generates and transmits the code autonomously. This substitution eliminates reliance on vulnerable communication infrastructure while maintaining authentication flexibility.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20250219839A1Method, apparatus, system, and non-transitory computer readable medium for user verification and authentication

Publication Date: 2025.07.03 MUNOMO LLC

AI summary

A method, apparatus, system, and non-transitory computer readable medium for performing user verification and authentication may include receiving a network request from a client device associated with an online service in response to a user access attempt of the online service associated with a user, the network request including message recipient information for a mobile-terminated (MT) short message service (SMS) message and a unique one-time password or pin (OTP) code associated with the user, calculating at least one first signature based on the network request and a shared secret key, the shared secret key shared with the client device, the at least one first signature associated with the user, transmitting a network response to the client device, the network response causing the client device to transmit a call-to-action (CTA) message to at least one user device associated with the user, and determining a status of the user access attempt.