SMS OTP Security Protocol Mitigating Rerouting Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
SMS-based two-factor authentication is vulnerable to rerouting attacks, which can compromise user accounts and data security, despite its widespread use due to user preference and ease of implementation.
Innovation Solution
The SMS OTP Security (SOS) protocol establishes a shared secret key between the server and mobile device using a provably secure authenticated key-change protocol, leveraging existing communications and public-key infrastructure, and minimizes overhead by deriving one-time passwords from a nonce sent via SMS, with the user scanning a QR code for registration, thus enhancing security without significant user burden or infrastructure changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SMS is used to deliver one-time passwords for two-factor authentication, then ease of operation and user preference are improved, but security is worsened due to vulnerability to rerouting attacks
Solution Approach 1:
The patent introduces an intermediary approach by using a QR code as a mediator between the user's device and the authentication system. Instead of directly relying on SMS messages which are vulnerable to rerouting, the system uses a QR code that encodes authentication data, which the user scans with their mobile device. This intermediary mechanism maintains user convenience while eliminating the security vulnerability of direct SMS delivery.
2Reliability
If a secure authentication protocol is implemented to protect against rerouting attacks, then security is improved, but device complexity and infrastructure requirements are worsened
Solution Approach 1:
The patent employs copying by generating a QR code that contains encoded authentication data. Instead of implementing complex cryptographic protocols directly in the authentication system, the system creates a copy of the necessary authentication information in QR code format. This allows the mobile device to perform the cryptographic operations locally when scanning the code, significantly reducing the complexity requirements of the server-side infrastructure while maintaining high security standards.
Data Source
AI summary
Various methods are provided for secure two-factor authentication, and more specifically, for incorporating a layer of security to two-factor authentication using Short Message Service in a manner virtually transparent to the end-user. Methods may include receiving a request for registration for two-factor authentication from a client including a username and password; providing a request for a mobile device number; receiving the mobile device number and a pre-shared key; sending to a mobile device an identity of the client and a server key share; receiving from the mobile device a mobile device key share; sending information corresponding to an exchange with the mobile device and a challenge derived from the pre-shared key to the client in response to the device key share corresponding to the server key share; receiving confirmation of registration with the mobile device; and establishing a shared key in response to verification of the confirmation.