Dual-Channel OTP Authentication Mitigating SIM Swap Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SMS-based one-time-passcode (OTP) authentication mechanisms are no longer secure due to SIM swap attacks and are user-unfriendly, requiring users to switch between devices or applications to view received OTPs.
Innovation Solution
A mobile device with a local one-time-passcode generating module that combines locally generated and remotely received OTPs, displaying them conveniently on the same application or message, thereby enhancing user experience and security by mitigating SIM swap attacks through dual-channel authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMS-based OTP authentication is used, then multi-factor authentication is provided, but security is compromised due to SIM swap attacks
Solution Approach 1:
The authentication system is segmented into multiple independent channels: SMS message channel for receiving OTP and display application channel for generating and displaying combined authentication code. This segmentation ensures that compromise of one channel (SMS via SIM swap) does not compromise the entire authentication system, as the display application maintains independent authentication capability through locally stored secrets and time-based OTP generation.
Solution Approach 2:
The display application acts as an intermediary between the SMS messaging system and the user. It receives the OTP via SMS, generates its own time-based OTP using locally stored secrets, combines these codes, and presents the final authentication credential to the user. This intermediary layer protects the user from direct exposure to SMS-based vulnerabilities while maintaining authentication functionality.
2Reliability
If users switch between devices or applications to view OTPs, then authentication is performed, but user experience deteriorates
Solution Approach 1:
The system merges the OTP receiving function (via SMS) and OTP display function (via application) into a single integrated display application. The application receives the OTP message through the device's SMS capability, processes it locally, generates additional authentication data, combines both, and displays the final authentication code within the same application interface. This eliminates the need for users to switch between multiple applications or devices.
Solution Approach 2:
The display application performs multiple functions: it acts as an SMS receiver, OTP generator, code combiner, and display interface all in one application. This multi-functionality consolidates what would otherwise require separate tools (SMS app, OTP generator app, browser) into a single universal authentication application, greatly improving ease of operation.
Data Source
Figure 1
Figure 2
Figure 3a
AI summary
Broadly speaking, embodiments of the present invention provide systems and methods to provide a solution to the SIM swap attack problem for users that possess smartphones. In particular, the systems and methods require an online banking customer to authenticate a transaction using a combined one-time password (OTP) formed of a remotely generated OTP (generated remote to the smartphone) and a locally generated OTP (generated on the smartphone).