Transformed OTP Authentication for SMS Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication (2FA) methods using SMS are vulnerable to interception and lack end-to-end encryption, making them insecure against hackers, and mobile numbers can be easily ported, leading to risks of unauthorized access and device theft.
Innovation Solution
A computer-implemented method that registers a device identifier with a transformation rule, generates and communicates a one-time password (OTP) to the user device, and authenticates the device based on the received transformed OTP, using algebraic or cryptographic functions to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMS is used to convey one-time password, then authentication can be performed, but the authentication is vulnerable to interception and lacks end-to-end encryption
Solution Approach 1:
The patent introduces an intermediary transformation process between the OTP generation and verification. The OTP is transformed using device-specific parameters (transformation rules) before being sent via SMS, and the same transformation is applied during verification. This intermediary transformation layer protects the authentication process from interception vulnerabilities by ensuring that even if the transformed OTP is intercepted, it cannot be used without the corresponding transformation rules stored securely on the legitimate device.
Solution Approach 2:
The patent changes the parameters of the OTP by applying transformation rules specific to each device. These transformation rules modify the OTP using device-specific identifiers or cryptographic keys, ensuring that the same OTP appears different to different devices. This parameter change approach ensures that intercepted transformed OTPs cannot be reused on other devices, thereby enhancing authentication security while maintaining SMS as the communication channel.
2Ease of operation
If mobile telephone number is used to identify user device, then authentication can be performed, but the number can be ported to another device allowing unauthorized access
Solution Approach 1:
The patent segments the device identification process into multiple components: the mobile telephone number is combined with device-specific transformation rules and parameters. Instead of relying solely on the portable phone number, the system creates a composite identification that includes non-portable device characteristics. The transformation rules are device-specific and cannot be transferred with the phone number, ensuring that even if the number is ported, the authentication cannot be completed without the corresponding device-specific transformation parameters.
Solution Approach 2:
The patent performs preliminary binding of transformation rules to specific devices during the registration phase. Before authentication can occur, the device must be registered and have its transformation rules securely stored. This preliminary action ensures that when a phone number is later ported to another device, the authentication fails because the new device does not have the pre-bound transformation rules associated with the original device, thereby preventing unauthorized access through number porting.
3Reliability
If transformation rules are applied to OTP, then authentication security is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The patent implements self-service by having each device autonomously perform the transformation of the OTP using its own stored transformation rules. The device automatically applies the transformation when receiving the OTP via SMS and automatically performs the inverse transformation when verifying the OTP during authentication. This self-service approach eliminates the need for manual transformation operations by users or complex server-side transformation processing, thereby reducing operational complexity while maintaining enhanced security through the transformation process.
Data Source
AI summary
Provided is a method, system, and apparatus for authenticating a user device. The method includes registering a device identifier with at least one transformation rule, receiving a request for authentication comprising a device identifier associated with a user device, obtaining a one-time password (OTP) in response to receiving the request, communicating the OTP to the user device, receiving a transformed OTP from the user device, and authenticating the user device based on the OTP, the transformed OTP, and the at least one transformation rule.