Dual Channel Short Message Authentication for Payment Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current short message payment methods via communication terminals face security risks due to plaintext transmission and stability issues, leading to potential leaks and repeated payments.
Innovation Solution
A dual channel asynchronous mechanism is implemented, using two proxy servers (SP1 and SP2) for secure transmission and random selection of SP2 for verification, generating a record number for payment confirmation, and storing account information in the payment system to prevent unauthorized transactions and repeated payments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If short messages are transmitted in plaintext format for authentication, then the ease of operation is improved, but the security is worsened due to potential leaks by proxy SP and unauthorized viewing
Solution Approach 1:
The authentication process is divided into two independent channels: Channel 1 transmits the authentication request in plaintext, while Channel 2 transmits the verification code in plaintext. This segmentation allows each channel to maintain simplicity while collectively providing security through mutual verification.
Solution Approach 2:
The system introduces an intermediary verification mechanism where the payment system generates and sends a verification code to the user's communication terminal through a different proxy SP. This intermediary step prevents direct authentication without verification, blocking unauthorized transactions while maintaining plaintext transmission benefits.
2Ease of operation
If short message gateways are used for authentication transmission, then the ease of operation is improved, but the reliability is worsened due to high loss rate and delay rate leading to repeated payments
Solution Approach 1:
The system performs preliminary action by creating a pending transaction record before the authentication is complete. The verification code is sent in advance, and the transaction is only finalized after successful verification. This preliminary setup prevents repeated payments by reserving funds before authentication completes.
Solution Approach 2:
The system implements feedback through the verification code mechanism. The payment system sends a verification code to the user, who must input it to confirm authentication. This feedback loop ensures the user is aware of the transaction and confirms it, preventing unauthorized or repeated payments due to message loss or delay.
3Object-affected harmful factors
If payment information is stored in the payment system instead of proxy SP, then the security is improved, but the device complexity is worsened
Solution Approach 1:
The system extracts the sensitive payment information and account binding data from the proxy SP and stores it exclusively in the payment system. This extraction centralizes security control in the payment system while keeping the proxy SP simple for message transmission only, resolving the complexity issue through clear separation of concerns.
Data Source
AI summary
The present invention discloses a method and a system for authentication via a communication terminal using short messages, in order to solve the problems that the content of a short message is easy to be leaked out by a proxy SP and that the loss and delay of a short message may lead to repeating user payments. The method includes: sending, by the communication terminal to a payment system via an SP1, a short message payment request including a payee's account identifier and a payment amount; creating, by the payment system, a payment record corresponding to the request and sending verification information to the communication terminal via an SP2, the verification information including the payee's account identifier and the payment amount; replying, by the communication terminal, confirmation information to the payment system via the SP2, upon confirming that the payee's account identifier and the payment amount in the verification information are correct; and performing, by the payment system, a payment operation. The present invention uses a dual channel (SP1and SP2) asynchronous transmission mechanism. The situation where any one of the channel is illegally controlled and thus short message information is leaked out can be prevented and the user can cancel a repeated payment in confirmation of the payment.