Automated Phone Verification Using TPM Nonce Signing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current multi-factor authentication methods, such as 2-factor authentication using SMS and voice, are manual, insecure, and resource-intensive, relying on basic and insecure features of smartphones, which exposes verification codes to interception and requires user intervention, leading to human errors and increased computational resources for code resending.
Innovation Solution
An encrypted phone verification system that automates the authentication process by using a Trusted Platform Module (TPM) to generate and sign a nonce, ensuring secure communication between devices without exposing the private key, thus providing a secure and automated multi-factor authentication method.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMS or voice verification is used for multi-factor authentication, then user verification can be performed, but the system becomes insecure and resource-intensive due to manual entry and code resending
Solution Approach 1:
The patent replaces the manual mechanical process of SMS/voice code delivery and user typing with an automated cryptographic system. A trusted platform module (TPM) generates and signs verification codes automatically, eliminating the need for manual entry and reducing computational overhead from code resending.
Solution Approach 2:
The verification system performs self-service through automated cryptographic operations. The TPM module automatically generates nonces, signs verification codes, and validates responses without requiring user intervention for code entry or resending, reducing computational resource consumption.
2Ease of operation
If SMS or voice verification is used, then authentication can be performed, but user intervention is required leading to manual errors and increased resource usage
Solution Approach 1:
The patent replaces the manual mechanical process of code entry with automated cryptographic verification. The system automatically generates, signs, and validates verification codes using TPM, eliminating human errors associated with manual typing while maintaining ease of operation through seamless automated processes.
3Ease of manufacture
If basic smartphone features (SMS/voice) are used for verification, then implementation is simple, but security is compromised due to interception risks
Solution Approach 1:
The patent introduces a trusted platform module (TPM) as an intermediary between the smartphone's basic features and the verification process. The TPM securely generates and manages cryptographic keys, signing verification codes to prevent interception risks while maintaining ease of implementation through hardware-based security.
Solution Approach 2:
The verification system combines multiple security layers: basic smartphone communication capabilities (SMS/voice) composite with advanced cryptographic functions (TPM key generation, nonce signing, verification). This composite approach maintains implementation simplicity while dramatically improving security against interception.
Data Source
AI summary
A encrypted verification system and method includes detecting an attempt to access a service requiring multi-factor authentication from a first user computing device, requesting a trusted platform module (TPM) public key of a second user computing device, the second user computing device being coupled to the first user computing device, generating a nonce in response to receiving the TPM public key of the second user computing device, sending the nonce for signature by a TPM private key of the second user computing device, receiving a signed nonce, wherein the signed nonce is signed by the TPM private key and decrypted using the TPM public key of the second user computing device, and determining that a value of the signed nonce matches a value of the nonce to authenticate the first user computing device and allowing access to the service.