One-Time Password Authentication via Mobile SMS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing username-password authentication method is prone to vulnerabilities, such as forgotten passwords and susceptibility to attacks, due to its complexity and difficulty in use, leading to potential account takeovers and security compromises.
Innovation Solution
A two-factor authentication system using a mobile phone number and a one-time, limited-life password, where the user receives a one-time password via text message, eliminating the need for remembering usernames and passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If username-password authentication is used, then users can maintain accounts with multiple service providers, but security is compromised due to password vulnerabilities and susceptibility to attacks
Solution Approach 1:
The authentication system is segmented into two distinct factors: something the user has (mobile device receiving one-time password) and something the user knows (one-time password). This segmentation separates the security function from the traditional username-password model, allowing each factor to specialize in its security role while simplifying the user experience.
Solution Approach 2:
A one-time password (OTP) serves as an intermediary between the user's mobile device and the service provider's authentication system. The OTP is generated by the mobile device, transmitted to the service provider, and used to verify the user's identity without exposing the user's personal information or requiring them to remember complex passwords.
2Reliability
If complex passwords are used to improve security, then account security improves, but usability deteriorates due to difficulty in remembering and typing
Solution Approach 1:
The system uses disposable one-time passwords that are valid for a single authentication attempt and then expire. Each OTP is generated fresh for each login attempt, used once, and then discarded. This eliminates the need for users to remember or reuse passwords, as each OTP is unique and short-lived, providing strong security without usability burdens.
Solution Approach 2:
The authentication system transitions from static passwords that users must remember to dynamic one-time passwords that are generated in real-time. The OTP changes with each authentication attempt, is valid only for a brief period, and is automatically invalidated after use. This dynamic approach provides adaptive security that responds to each login attempt individually.
3Ease of operation
If users reuse passwords across multiple accounts to simplify login, then ease of operation improves, but security deteriorates due to vulnerability to attacks
Solution Approach 1:
The system extracts the password memorization burden from the authentication process entirely. Instead of requiring users to remember and reuse passwords across multiple accounts, the system uses the user's mobile device to generate one-time passwords. This extraction eliminates the security risk of password reuse while maintaining login convenience, as users only need to access their mobile device.
4Reliability
If traditional authentication systems are used, then service providers can verify user identity, but the system is vulnerable to dictionary attacks and credential compromise
Solution Approach 1:
The system implements periodic authentication where a fresh one-time password is generated for each login attempt. The OTP has a limited validity period and must be used within that timeframe. This periodic regeneration of credentials prevents attackers from using stolen or guessed passwords, as each OTP is valid only for a brief window and cannot be reused after expiration.
Data Source
AI summary
Methods and systems for online authentication eliminate the common username plus password combination, using instead a novel two-factor authentication that employs a mobile phone number and a one-time, limited life password. The user provides the mobile phone number to a login dialog and receives, from a service provider, the one-time password, e.g., via a text message, at the mobile device to which the phone number belongs. If the user enters the one-time password before it expires, the user is authenticated and logged in. A method for authentication or authorization to a website includes: receiving a phone number from a user via a communication network in response to a login prompt displayed to the user; transmitting a one-time password to the phone number using text messaging; and in response to receiving the one-time password back from the user, authenticating the user for transactions with the website.