ICC-Based Two-Factor Authentication Without Manual OTP Entry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing two-factor authentication (2FA) methods, such as SMS-based one-time passwords (OTPs), are vulnerable to interception and require manual user input, leading to security risks and user inconvenience.
Innovation Solution
A method utilizing a first device app and a second app to obtain an authentication token from an Entitlement Configuration Server (ECS) through ICC-based authentication, eliminating the need for manual OTP input and enhancing security by using concealed identifiers and challenge-response mechanisms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMS-based OTP is used for 2FA, then the authentication process is simple to implement, but the security is compromised due to interception vulnerabilities
Solution Approach 1:
The patent introduces an intermediary authentication mechanism using a trusted native application and device-level security components (Keystore, biometric authentication) to mediate between the user and the service provider. This intermediary layer prevents direct exposure of OTP to potential attackers while maintaining authentication security.
Solution Approach 2:
The patent replaces the traditional SMS-based mechanical authentication system with a software-based authentication system using native applications, device-level security APIs, and encrypted communication channels. This substitution eliminates the vulnerabilities of SMS interception while providing stronger security guarantees.
2Ease of operation
If manual OTP input is required, then the authentication process is secure, but the user convenience deteriorates
Solution Approach 1:
The patent enables the native application to automatically perform authentication operations without requiring manual user input. The application uses device-level security features (biometric authentication, Keystore) to automatically generate and submit authentication tokens, providing both convenience and security.
Solution Approach 2:
The patent performs preliminary authentication actions by establishing secure device-level credentials and biometric verification before the actual authentication process. This preliminary setup enables automatic authentication without manual OTP input while maintaining strong security guarantees.
3Reliability
If traditional OTP methods are used, then the implementation is straightforward, but the risk of OTP leakage increases
Solution Approach 1:
The patent moves authentication from the traditional SMS message dimension to the device-level security dimension, using operating system APIs, secure storage, and biometric authentication layers. This dimensional shift prevents OTP leakage by operating in a more secure computational layer rather than relying on vulnerable SMS channels.
Solution Approach 2:
The patent segments the authentication process into distinct secure components: device credential verification, biometric authentication, encrypted token generation, and secure communication with the service provider. This segmentation isolates critical security functions from potential attack vectors while maintaining overall system security.
Data Source
AI summary
A method performed by an entitlement configuration server (106). The method includes receiving a validation request message comprising a first authorization token, authToken, and a phone number. The method also includes retrieving a second authToken, wherein the retrieving comprises using the phone number to retrieve the second authToken. The method also includes determining whether the first authToken is valid, wherein the determining comprises determining whether the first authToken is identical to the secondauthToken. The method also includes transmitting a validation response message responsive to the validation request message, wherein the validation response message indicates whether or not the first authToken is valid. Further methods, apparatus, computer programs and carriers are also disclosed.