OTP Transaction Authorization Using Split Response Code Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing one-time password (OTP) schemes are vulnerable to security threats from stolen or emulated user devices, compromising the integrity of two-factor authentication processes without increasing computational resources.
Innovation Solution
A method and system that generates and verifies OTPs with a first and second portion, matching against a user code stored in a data storage device, and determines the position preference of the user code based on user profiles to enhance authorization, ensuring secure transaction processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP schemes are used for two-factor authentication, then transaction authorization can be achieved, but security is compromised due to stolen or emulated user devices
Solution Approach 1:
The response code is segmented into multiple portions, where the first portion corresponds to the OTP and the second portion corresponds to the user code. This segmentation allows the system to verify both the time-sensitive OTP and the pre-shared user code separately, preventing attackers from successfully spoofing authentication even if they intercept one portion of the response code.
Solution Approach 2:
The user code is predetermined and stored securely in the payment card processor system before the transaction occurs. This preliminary setup creates a second layer of verification that exists independently of the user device, allowing the system to validate that the response code contains both the correct OTP and the correct pre-shared user code, thereby preventing device emulation attacks.
2Reliability
If additional verification steps are added to enhance security, then security against device theft improves, but transaction process time increases
Solution Approach 1:
The system merges the OTP verification and user code verification into a single response code submission step. The user enters one response code that contains both the OTP portion and the user code portion, and the system verifies both portions simultaneously. This combining of verification steps into a single user action prevents additional time loss while maintaining enhanced security.
Solution Approach 2:
The authentication process maintains continuity by verifying both the OTP and user code in a single automated processing step without requiring separate user actions. The system continuously validates both portions of the response code against the expected values, ensuring that the enhanced security checks do not interrupt or extend the transaction flow beyond the normal OTP verification time.
3Reliability
If multiple code verifications are performed, then security against emulation attacks improves, but computational resources increase
Solution Approach 1:
The system performs verification of only the necessary portions of the response code. Instead of re-verification or multiple passes, the system extracts the first portion (OTP) and second portion (user code) and verifies each against its corresponding expected value in a single processing operation. This partial verification approach provides sufficient security against emulation attacks without the excessive computational overhead of more complex verification schemes.
Data Source
AI summary
Described are a method, system, and computer program product for enhanced one-time password-based transaction authorization. The method includes receiving a transaction request initiated by a user, and generating and transmitting a one-time password (OTP) to a user communication device of the user. The method also includes receiving a response code from the user communication device of the user. The method further includes verifying that the first portion of the response code matches the OTP. The method further includes identifying a user code stored in association with the user and verifying that the second portion of the response code matches the user code. The method further includes, in response to verifying that the first portion of the response code matches the OTP and that the second portion of the response code matches the user code, automatically authorizing the transaction request to be processed in an electronic payment processing network.