IVR Pre-Authentication Using OTP-Appended Phone Numbers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional interactive voice response systems are susceptible to unauthorized access as they rely on user-provided authentication data, which can be compromised, allowing unauthorized users to take over user accounts.
Innovation Solution
Implementing a pre-authentication mechanism using one-time passcodes appended to telephone numbers, validated by the IVR system, to authenticate users before engaging in a call, thereby bypassing subsequent authentication requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication methods using known user data (e.g., date of birth) are used, then the authentication process is simple and familiar to users, but the system becomes vulnerable to unauthorized access when such data is compromised
Solution Approach 1:
The system performs preliminary authentication by generating and validating a one-time passcode (OTP) before the actual IVR call is established. The computing device receives the OTP, appends it to the telephone number, and initiates the call with this pre-authenticated identifier. This preliminary authentication action ensures that only authorized users can access the IVR system, resolving the security vulnerability of conventional methods while maintaining a relatively simple user experience.
Solution Approach 2:
The one-time passcode serves as an intermediary element between the user and the IVR system. Instead of directly transmitting user authentication data or relying on known personal information, the system introduces the OTP as a temporary, single-use credential that mediates the authentication process. This intermediary mechanism enhances security without requiring users to remember complex passwords or undergo complicated authentication procedures.
2Reliability
If one-time passcodes are appended to telephone numbers for pre-authentication, then authentication security is enhanced, but the system complexity increases due to additional validation steps
Solution Approach 1:
The system merges the authentication credential (one-time passcode) with the existing telephone number identifier by appending the OTP as a suffix to the phone number. This combining approach allows the IVR system to recognize and validate the pre-authenticated call without requiring separate authentication channels or complex integration with existing telephony infrastructure. The merged identifier seamlessly integrates security enhancement with the conventional call initiation process.
3Reliability
If pre-authentication is implemented before IVR calls, then unauthorized access is prevented, but the user experience may be affected by additional authentication steps
Solution Approach 1:
The system enables self-service authentication by allowing users to initiate calls with pre-authenticated telephone numbers that already contain their one-time passcodes. The authentication process is automated and performed in the background without requiring users to manually provide additional credentials or interact with authentication prompts during the call. This self-service approach maintains ease of operation while ensuring secure access control.
Data Source
AI summary
Arrangements for pre-authenticating users to interactive voice response (IVR) systems are provided. In some examples, a computing device may receive and store a valid telephone number associated with an enterprise organization IVR system and an enterprise organization application programming interface (API) access key. A request to initiate a communication session with the IVR system may be received and the request may include a telephone number. If the telephone number matches the valid telephone number, an API call to the enterprise organization may be made and a one-time passcode (OTP) may be received. The telephone number may be appended to include the OTP as a suffix and the communication session with the IVR system may be initiated. The IVR system may extract the OTP and validate the OTP. If the OTP is validated, the communication session may be initiated as a pre-authenticated call.