Wireless Account Change Authentication with Pre-OTP SMS Confirmation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cellular subscriber accounts are increasingly vulnerable to phishing attacks, where cyber-criminals exploit one-time passwords (OTPs) sent via SMS to gain unauthorized access and modify accounts.
Innovation Solution
Implementing an additional confirmation step requiring account holders to positively confirm account modifications via SMS before generating the OTP, ensuring the account holder's intent is verified before proceeding with the requested change.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTP is sent via SMS for account modification authorization, then account security is improved, but the system becomes vulnerable to phishing attacks where criminals trick users into revealing the OTP
Solution Approach 1:
The system sends a preliminary confirmation request via SMS to the user's registered phone number before generating and sending the OTP. This preliminary action verifies that the user is present and aware of the account modification attempt, so even if a phishing attack occurs later, the attacker cannot obtain authorization without the user's phone receiving and confirming the initial request.
Solution Approach 2:
The system introduces an intermediary confirmation step between the user's account modification request and the OTP generation. This intermediary SMS confirmation acts as a mediator that breaks the direct phishing attack chain, as the attacker would need to intercept both the confirmation request and the subsequent OTP, which is significantly more difficult.
2Reliability
If an additional confirmation step is added to verify account holder intent before generating OTP, then security against unauthorized modifications is improved, but the authentication process complexity increases
Solution Approach 1:
The system uses a universal SMS messaging interface for multiple functions: sending the confirmation request, receiving the user's confirmation response, and subsequently sending the OTP. This multi-functional use of the SMS channel avoids introducing additional complex communication infrastructure while achieving enhanced security.
Solution Approach 2:
The system leverages the user's existing smartphone and SMS capability to perform the confirmation step. The user simply needs to reply to the SMS message, utilizing their own device's built-in functionality rather than requiring them to interact with a complex new interface or additional authentication hardware.
3Reliability
If OTP generation is delayed until after user confirmation, then prevention of unauthorized account changes is improved, but the time to complete legitimate account modifications increases
Solution Approach 1:
The system performs the confirmation request in advance, but once confirmed, immediately generates and sends the OTP without unnecessary delays. The preliminary confirmation ensures security, while the rapid subsequent OTP generation minimizes time loss for legitimate users who have already passed the confirmation step.
Solution Approach 2:
After the user provides confirmation, the system rushes through the OTP generation and delivery process, skipping any unnecessary validation steps or delays. This ensures that once the user has confirmed their intent, the authentication process completes as quickly as possible, minimizing the time penalty for legitimate modifications.
Data Source
AI summary
Systems and methods are provided for authenticating account modifications in a wireless network. Methods include detecting a request to modify an account of an account holder, at an authentication portal. The methods further include transmitting a request to generate a one-time password (OTP) to an identity provider, wherein the request to generate the OTP includes a confirmation flag indicating that confirmation by the account holder is required before generating the OTP. The methods further include transmitting an SMS message to the account holder identifying the request to modify the account and requesting a positive confirmation from the account holder to authorize the requested account modification. The methods further include transmitting the OTP via SMS to the account holder upon receiving the positive confirmation from the account holder.