Push Notification Authentication for Automatic OTP Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication systems face challenges with security, ease of use, and privacy, particularly with software-based OTP generators on user devices, which are vulnerable to phishing and malware attacks and require users to manually enter OTPs, leading to usability issues.
Innovation Solution
A network-based multi-factor authentication approach using a push service to confirm network resource access requests, where a first OTP is generated by an authentication server and verified by a client device through biometric or PIN authentication, eliminating the need for manual OTP entry and enhancing security by separating authentication channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-based OTP generators are installed on user devices to eliminate hardware tokens, then ease of use is improved, but security is worsened due to vulnerability to phishing and malware attacks
Solution Approach 1:
The patent introduces a push notification service as an intermediary between the authentication server and the OTP generator application. The push notification delivers access attributes to the application, enabling automatic OTP generation without direct user interaction with potentially malicious websites. This intermediary layer protects against phishing attacks by verifying access attributes server-side before triggering OTP generation.
2Reliability
If users manually enter OTPs into web applications, then authentication security is improved, but ease of use is worsened due to switching between applications and manual entry requirements
Solution Approach 1:
The OTP generator application on the user device performs self-service by automatically generating and sending OTPs to the web application in response to push notifications. The system eliminates manual OTP entry by implementing automatic OTP generation triggered by server-pushed access attributes, reducing user effort while maintaining security through automated verification.
3Ease of operation
If OTPs are generated on the same device attempting to access network resources, then ease of use is improved, but security is worsened due to potential malware attacks on authentication credentials
Solution Approach 1:
The patent segments the authentication process into separate functional components: the authentication server that validates access attributes, the push notification service that delivers authentication challenges, and the OTP generator application that creates OTPs. This segmentation isolates the OTP generation function from potential malware on the device, as the critical authentication logic resides on the secure server side.
4Ease of operation
If push notifications are used to deliver access attributes to client devices, then ease of use is improved by enabling automatic OTP generation, but device complexity is worsened due to integration of multiple authentication components
Solution Approach 1:
The OTP generator application serves multiple functions: receiving push notifications, validating access attributes, generating OTPs, and sending them to web applications. By consolidating these functions into a single multi-functional application, the system reduces overall device complexity compared to having separate dedicated components for each function.
Data Source
AI summary
A network-based multi-factor authentication approach is provided. A request to access a protected network resource and user credentials are received from a client by an application server hosting the resource. Attributes associated with the request are obtained. After determining the credentials are valid, the access attributes are provided to an authentication server. A first OTP is generated by the authentication server. The client is caused to seek confirmation from the user regarding the request and the associated attributes, by sending a push notification to the client. Responsive to authentication of the user to an OTP generator application running on the client via a biometric sensor or a PIN associated with the client: (i) a second OTP is generated by the OTP generator; and (ii) the application server is caused to grant the request by the OTP generator sending the second OTP to the application server or to the authentication server.