One-Time Security Code Generation Using Pseudorandom Strings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for SMS and mobile transactions are vulnerable to fraud, particularly in 'card not present' situations, as they lack robust identity verification and are susceptible to phishing and shoulder surfing, especially when using static PIN codes and traditional encryption methods.
Innovation Solution
A method and system that uses non-repeating pseudorandom strings on both the server and client devices to generate and verify a one-time security code by applying a user-specific PIN to the pseudorandom string, ensuring authentication by matching the generated sequence of digits, which enhances security and prevents interception or spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a static PIN code is used for authentication, then the system is simple to operate, but it is vulnerable to interception and forgery
Solution Approach 1:
The patent transforms the static PIN code into a dynamic authentication mechanism by generating a one-time code from a pseudorandom string using the PIN as a seed. This dynamic code changes with each transaction, preventing interception and replay attacks while maintaining user-friendly operation through automated generation on mobile devices.
Solution Approach 2:
The patent changes the parameter of the authentication code from static to dynamic by using the PIN to select characters from a pseudorandom string at specific positions. This transformation maintains the simplicity of using a memorable PIN while generating a unique, non-repeating authentication code for each transaction.
2Ease of manufacture
If traditional encryption methods are used, then the system is easy to implement, but it is susceptible to phishing and shoulder surfing
Solution Approach 1:
The patent implements preliminary action by pre-distributing identical pseudorandom strings to both the server and the user's mobile device before any transaction occurs. This pre-shared secret enables secure authentication without requiring complex real-time encryption infrastructure, while the one-time nature of the generated codes prevents phishing attacks.
Solution Approach 2:
The patent introduces a pseudorandom string as an intermediary element that mediates between the user's PIN and the authentication code. This intermediary adds a layer of security that prevents shoulder surfing and phishing, as the authentication code cannot be derived without both the PIN and the pseudorandom string, while keeping the system relatively simple to implement.
3Reliability
If PKI is used for identity verification, then security is improved, but device complexity and computing resources increase significantly
Solution Approach 1:
The patent replaces complex, long-term PKI infrastructure with simple, disposable one-time authentication codes generated from pseudorandom strings. This approach provides strong security for each transaction without requiring users to manage complex cryptographic keys or certificates, making it suitable for mobile devices with limited computing resources.
4Reliability
If Smart Cards are deployed for fraud prevention, then security against card theft is improved, but the cost of equipment and cards increases
Solution Approach 1:
The patent makes the mobile device itself a universal authentication tool that can replace specialized hardware like Smart Cards. By using the mobile device's existing capabilities (message reception and simple computation) to generate and verify one-time codes, the system provides fraud prevention without requiring additional expensive hardware infrastructure at merchant locations.
Data Source
AI summary
A method for a receiver of an electronic message to authenticate an identity of a sender of the electronic message. The message contains a one-time security code in the form of a string of characters generated by selecting characters from a sender-side non-repeating pseudorandom string of characters. This is done by applying a user-specific PIN in the form of a first sequence of digits to the pseudorandom security string at the sender by sequentially selecting numerical positions in the sender-side pseudorandom string on the basis of the numbers in the user-specific PIN, taken in positional order, and returning the characters thereby selected from the sender-side pseudorandom string in sequence so as to form the one-time security code. Upon receipt of the message, the receiver correlates the characters in the one-time security code with characters in a receiver-side non-repeating pseudorandom string of characters, identical to the sender-side pseudorandom string, by considering the characters of the one-time security code in sequence and identifying a numerical position of each character of the one-time security code in the receiver-side pseudorandom array to thereby generate second sequence of digits. The identity of the sender is authenticated when the second sequence of digits matches the user-specific PIN.