Transaction Authorization via Split Authentication Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OTP-based authentication methods for transactions are insecure as they allow unauthorized access to transaction applications, which can retrieve and misuse one-time passwords, compromising transaction security.
Innovation Solution
A transaction authorization method that generates a master authentication code split into a first and second authentication code, where the first code is sent to the transaction application and the second code is sent to the user via registered contact information, requiring both codes to generate a response code for transaction authorization, ensuring only the intended application can authenticate the transaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OTP is communicated to user via registered contact information linked to computing device, then user can easily receive and submit OTP for authentication, but any transaction application installed on the computing device can access the OTP from message repository and perform fraudulent transactions
Solution Approach 1:
The authentication code is segmented into two separate parts: a first authentication code communicated to the transaction application and a second authentication code communicated to the user via registered contact information. The transaction application generates the response code by combining both codes, ensuring that neither code alone can compromise security while maintaining ease of operation.
2Adaptability or versatility
If transaction application has access to user's personal data and message repository on computing device, then user can initiate transactions conveniently, but unauthorized application can retrieve OTP and misuse it for fraudulent transactions
Solution Approach 1:
The authentication credentials are divided into two segments: the first authentication code is provided to the transaction application, while the second authentication code is communicated to the user through registered contact information. The response code requires combination of both segments, preventing unauthorized applications from misusing authentication credentials even if they access the message repository.
Solution Approach 2:
The server acts as an intermediary that generates and distributes the two separate authentication codes. It receives the response code from the transaction application, verifies it against the combined authentication codes, and processes the transaction. This intermediary mechanism ensures secure verification while allowing the transaction application to function with limited access.
Data Source
AI summary
A method for transaction authorization includes generation of a master authentication code based on an authorization request for a transaction by a server. The transaction is initiated by a user by way of a transaction application installed on a user-computing device. The server splits the master authentication code into a first authentication code and a second authentication code. The first authentication code is communicated to the transaction application and the second authentication code is communicated to the user by the server. The transaction application generates a response code based on the first authentication code and the second authentication code. The server receives the response code from the transaction application and processes the transaction based on a match between the response code and the master authentication code.