Push Notification Token for Secure OTP Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Two-factor authentication using one-time passcodes (OTP) sent via text messages is unreliable due to potential delays in message delivery and vulnerability to SIM hijacking, where fraudsters can intercept the OTP, compromising user authentication.
Innovation Solution
Enrolling a user's mobile device as a trusted device with a vendor software using network identification and associating it with authentication information such as a push notification token and cryptographic key, allowing cryptographic authentication or secure OTP transmission as a push notification, thereby preventing SIM hijacking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTP is sent via text message, then authentication can be performed, but delivery reliability is poor and SIM hijacking vulnerability increases
Solution Approach 1:
The patent introduces a push notification token as an intermediary mechanism. Instead of directly sending OTP via text message to the phone number (which is vulnerable to SIM hijacking), the system uses a push notification token that is bound to the specific mobile device. This token acts as a mediator that delivers authentication codes through a secure channel (push notification) that cannot be intercepted by SIM hijacking, thus resolving the contradiction between authentication capability and security vulnerability
Solution Approach 2:
The patent replaces the traditional SMS text message delivery mechanism with a push notification mechanism. Push notifications are delivered through a different technical infrastructure (application layer vs. telecom network layer) that is not susceptible to SIM hijacking attacks. This substitution changes the delivery mechanism from a telecom-based system to an application-based system, eliminating the security vulnerability while maintaining authentication functionality
2Reliability
If OTP is sent via text message, then authentication can be performed, but message delivery timing is unreliable
Solution Approach 1:
The push notification token serves as an intermediary that enables more reliable and timely delivery of authentication codes. Push notifications are delivered instantaneously through the device's notification system, bypassing the delays inherent in SMS delivery networks. This intermediary mechanism ensures that the authentication code reaches the user immediately, resolving the timing unreliability issue
3Object-affected harmful factors
If push notification is used instead of text message, then security against SIM hijacking is improved, but device enrollment complexity increases
Solution Approach 1:
The system performs preliminary action by enrolling the mobile device and generating a push notification token during the initial setup phase. This enrollment process, while slightly more complex than traditional SMS-based authentication, is performed only once. After enrollment, the device can authenticate securely without SIM hijacking vulnerability for all subsequent logins. The preliminary action of enrollment establishes a long-term secure relationship, making the ongoing process simpler and more secure
Data Source
AI summary
An authentication server enrolls a user's mobile device as a trusted device with a vendor software after verifying the network ID of the user's mobile device. The authentication server associates the network ID in an authentication entry with authentication information such as a push notification token and cryptographic key. Later, when the user attempts to log in to the vendor software, the authentication server may attempt to cryptographically authenticate the user. Otherwise, the authentication server may use the push notification token to transmit an OTP to the user's mobile device as a push notification.