Two-Factor Mutual Authentication for Secure Online Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current online transaction systems face security issues due to weaknesses in their protocols, such as the use of static passcodes, which can be intercepted, and lack of authentication for service providers, making transactions vulnerable to unauthorized access and fraud.
Innovation Solution
A method and system utilizing two-factor mutual authentication, involving a one-time passcode and a personal assurance message, to verify the authenticity of both the user and the service provider before proceeding with a secure transaction, ensuring that sensitive information is only shared with authenticated parties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static passcodes are used for authentication, then the system is simple to operate, but security is compromised as passcodes can be intercepted and reverse engineered
Solution Approach 1:
The patent replaces static passcodes with dynamic one-time passcodes that change with each transaction. The passcode is generated dynamically based on transaction parameters and cannot be reused or intercepted, thereby maintaining ease of use while significantly improving security against interception and reverse engineering attacks
Solution Approach 2:
The authentication mechanism changes from using fixed static passcodes to variable one-time passcodes that are generated based on transaction-specific parameters. This parameter change ensures that even if a passcode is intercepted, it cannot be reused for subsequent transactions, thus resolving the security vulnerability while maintaining operational simplicity
2Device complexity
If no authentication mechanism is implemented for service providers, then the system is simple, but unauthorized access and fraud increase
Solution Approach 1:
The patent introduces a certification authority as an intermediary that issues digital certificates to both users and service providers. This intermediary mechanism enables mutual authentication without requiring direct complex communication protocols between all parties, thereby preventing unauthorized access while maintaining system simplicity
Solution Approach 2:
The patent replaces traditional mechanical authentication (static passcodes) with cryptographic digital certificates and one-time passcodes. This substitution provides robust authentication for both users and service providers, preventing fraud and unauthorized access while keeping the implementation relatively simple through standard cryptographic protocols
3Device complexity
If one-factor authentication is used, then the system is simple to implement, but security against information theft is insufficient
Solution Approach 1:
The patent segments authentication into two distinct factors: something the user knows (password) and something the user has (one-time passcode). This segmentation ensures that compromising one factor does not compromise security, as both factors are required for successful authentication, thereby protecting information while maintaining reasonable system complexity
Solution Approach 2:
The patent transitions from one-factor authentication to two-factor authentication by adding an additional dimension of security. The one-time passcode serves as a temporary, single-use credential that adds a time-sensitive dimension to authentication, making information theft significantly more difficult while keeping the implementation relatively straightforward
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for performing a secure transaction are disclosed. A service provider system may receive an account identifier and a one-time passcode from a user system via a communication network. The service provider system may determine whether the one-time passcode is valid. If the one-time passcode is valid, the service provider system may transmit a personal assurance message to the user system via the communication network. If the personal assurance message is verified, the service provider may receive a password from the user system via the communication network and determine whether the password is valid. If the password is valid, the user system and the service provider system may then perform a secure transaction.