System and method for enabling secure authentication
AssigneeCryptomathic Ltd.
InventorsDan Quirke, Michael K. Bond, Peter Landrock
Life of this patent
Estimating the term…
Abstract
Broadly speaking, embodiments of the present invention provide systems and methods to provide a solution to the SIM swap attack problem for users that possess smartphones. In particular, the systems and methods require an online banking customer to authenticate a transaction using a combined one-time password (OTP) formed of a remotely generated OTP (generated remote to the smartphone) and a locally generated OTP (generated on the smartphone).
Claims16
A mobile device for enabling secure authentication between a user and a third party using a one-time-passcode (OTP) authentication mechanism, the mobile device comprising:
- a mobile device screen for displaying information to the user;
- and
- first circuitry configured to implement a local one-time-passcode generating module which is configured to:
- generate at regular intervals a local one-time-passcode which is unique to the mobile device and is valid for use in a single authentication, wherein the local one-time-passcode is a regularly changing local one-time-passcode;
- receive, from second circuitry configured to implement a remote authentication module, a third party one-time-passcode which is unique to the third party via a short message service (SMS) message sent from the remote authentication module;
- and
- combine the regularly changing locally generated local one-time-passcode with the received third party one-time-passcode to generate a combined one-time-passcode for authenticating the user to the third party,
- wherein the combined one-time-passcode is displayed to the user on the mobile device screen.
A system for enabling secure authentication between a user and a third party using a one-time-passcode (OTP) authentication mechanism, the system comprising:
- first circuitry configured to implement remote authentication module;
- and
- a mobile device comprising:
- a mobile device screen for displaying information to the user;
- and
- second circuitry configured to implement a local one-time-passcode generating module which is configured to:
- generate at regular intervals a local one-time-passcode which is unique to the mobile device and is valid for use in a single transaction, wherein the local one-time-passcode is a regularly changing local one-time-passcode;
- receive, from the remote authentication module, a third party one-time-passcode which is unique to the received third party via a short message service (SMS) message sent from the remote authentication module;
- and
- combine the regularly changing locally generated local one-time-passcode with the received third party one-time-passcode to generate a combined one-time-passcode for authenticating the user to the third party, wherein the combined one-time-passcode is displayed to the user on the mobile device screen.
A method of using a mobile device to enable secure authentication between a user and a third party using a one-time-passcode (OTP) authentication mechanism, the method comprising:
- generating at regular intervals, at the mobile device, a local one-time-passcode which is unique to the mobile device, wherein the local one-time-passcode is regularly changing local one-time-passcode;
- receive, at the mobile device, a third party one-time-passcode from circuitry implementing a remote authentication module, the third party one-time-passcode received via a short message service (SMS) message sent from the remote authentication module, wherein the third party one-time-passcode is unique to the third party;
- combining, at the mobile device, the regularly changing locally generated local one-time-passcode with the received third party one-time-passcode to generate a combined one-time-passcode for authenticating the user to the third party;
- and
- displaying, at the mobile device, the combined one-time-passcode.
A non-transitory computer-readable medium for enabling secure authentication between a user and a third party using a one-time-passcode (OTP) authentication mechanism, the non-transitory computer-readable medium storing instructions that, when executed by a hardware processor, cause the hardware processor to perform the method of:
- generating at regular intervals, at the hardware processor, a local one-time-passcode which is unique to the hardware processor, wherein the local one-time passcode is a regularly changing local one-time-passcode;
- receive, at the hardware processor, a third party one-time-passcode from circuitry implementing a remote authentication module, the third party one-time-passcode received via a short message service (SMS) message sent from the remote authentication module, wherein the third party one-time-passcode is unique to the third party;
- combining, at the hardware processor, the regularly changing locally generated local one-time-passcode with the received third party one-time-passcode to generate a combined one-time-passcode for authenticating the user to the third party;
- and
- displaying the combined one-time-passcode.
Dependencies are inferred from the claim text.