Mobile Authentication via GTP Tunnel HTTP Redirect
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional mobile authentication methods using SMS OTP are insecure due to risks of intercept and spoofing, allowing hackers to impersonate users by redirecting and using the OTP without the victim's knowledge.
Innovation Solution
Implementing a mobile authentication system that uses HTTP Redirect in GTP tunnels to securely authenticate users by generating a one-time token, capturing GTP session information, and injecting a HTTP-302 response packet to redirect the mobile device to a designated authentication page, ensuring secure communication through APIs and secure channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMS OTP is used for mobile authentication, then the authentication process is simple and widely compatible, but the security is compromised due to intercept and spoofing risks
Solution Approach 1:
The patent introduces an authentication server as an intermediary component that mediates between the mobile device and the external system. This server generates secure authentication tokens, manages the authentication workflow, and communicates with both the mobile device via HTTP redirects and the external system, thereby enhancing security while maintaining system simplicity
Solution Approach 2:
The patent replaces the traditional SMS-based mechanical authentication system with an HTTP redirect-based electronic authentication system. By using HTTP redirects to deliver authentication tokens instead of SMS messages, the system achieves higher security through encrypted web communication while maintaining ease of implementation
2Reliability
If HTTP Redirect in GTP tunnels is used for authentication, then the security against intercept and spoofing is improved, but the device complexity increases
Solution Approach 1:
The mobile device automatically handles the authentication process through its web browser by following HTTP redirects. The device receives an initial HTTP request, automatically follows the redirect to an authentication page, receives another redirect with the authentication token, and completes the authentication without requiring user intervention beyond the initial action, thereby maintaining ease of operation despite enhanced security
Solution Approach 2:
The authentication server performs preliminary actions by pre-generating authentication tokens and setting up the HTTP redirect chain before the actual authentication is needed. The server prepares the authentication workflow in advance, including creating secure tokens and establishing the redirect path, which streamlines the actual authentication process when it occurs
Data Source
AI summary
This invention is a system and method for mobile authentication using HTTP redirect in GTP tunnels. The authentication procedure generates a one-time-token that returns to the Enterprise application that requests the authentication. The authentication platform injects a HTTP redirect response to the mobile device via the GTP-U tunnel that corresponds to the GTP session of the inputted-MSISDN. The HTTP redirect response carries a URL with the one-time-token as parameter. The Enterprise application authenticates the HTTP request by comparing the one-time-token in the HTTP request parameter against the value returned by the authentication platform during its authentication request API call.