Location-Based Account Authentication Against SMS OTP Phishing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cellular subscriber accounts are vulnerable to phishing attacks that exploit one-time passwords (OTPs) sent via SMS, allowing cyber-criminals to gain unauthorized access and modify account information.
Innovation Solution
Implement a location-based authentication system that requires a positive confirmation from the account holder, including the originating location, before sending an OTP for account modifications, using IP address detection and SMS messaging to verify the request's legitimacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If location-based authentication with SMS confirmation is implemented, then account security is improved, but authentication complexity and user convenience are worsened
Solution Approach 1:
The system performs preliminary actions by detecting the request location and IP address before processing the account modification. The location information is captured and stored in advance, then used to generate targeted SMS confirmation messages that include location details, ensuring the user is aware of where the modification request originated before receiving the OTP.
Solution Approach 2:
The patent introduces an intermediary layer of location-based verification between the account modification request and the OTP delivery. The SMS confirmation message acts as a mediator that includes location information, requiring the user to verify both the location and the modification request before receiving the actual authentication code, thus adding a security layer without directly exposing the OTP to phishing attacks.
2Object-affected harmful factors
If location verification and SMS confirmation steps are added, then phishing attack resistance is improved, but user convenience and operation speed are worsened
Solution Approach 1:
The system implements feedback by sending SMS confirmation messages to the user that include location information about the modification request. The user receives feedback about where the request originated and must explicitly confirm or deny it. This feedback loop ensures the user is aware of the context before receiving the OTP, making it difficult for phishing attacks to succeed without the user's knowledge.
Solution Approach 2:
The patent adds another dimension to authentication by incorporating location data into the verification process. Instead of just verifying the user's identity through OTP, the system now verifies both identity and location context. The SMS message includes location details (city, state, country) as an additional verification dimension, making phishing attacks more difficult since the attacker cannot replicate the specific location context.
3Reliability
If multiple verification steps including location detection and SMS confirmation are implemented, then account protection is improved, but processing time and system response speed are worsened
Solution Approach 1:
The system performs location detection and IP address capture as preliminary actions immediately when the modification request is received. This location information is captured and stored before the OTP generation and sending process begins. By performing this verification action in advance and in parallel with other authentication steps, the system minimizes the total processing time while maintaining security.
Solution Approach 2:
The authentication process maintains continuity by seamlessly integrating location verification, SMS confirmation, and OTP delivery into a continuous flow. The system sends the SMS confirmation message immediately after location detection, and the OTP is generated and sent automatically upon user confirmation. This continuous processing without unnecessary delays maintains useful action throughout the authentication sequence.
Data Source
AI summary
Systems and methods are provided for authenticating account modifications in a wireless network. Methods include detecting a request to modify an account of an account holder at an authentication portal and further detecting an originating IP address associated with a location of the request. The methods further include transmitting an SMS message to the account holder identifying the request and a location of the request to modify the account and requesting a positive confirmation from the account holder to authorize the requested account modification. The methods further include transmitting the OTP via SMS to the account holder upon receiving the positive confirmation from the account holder.