Number Verify APIs for enterprises

Secure and user friendly authentication use case

Service providers provide 2 factor authentication using SMS One-Time-Passwords. Yet they are in a unique position to offer 2-factor authentication based on their assets of knowing their mobile subscribers well.

Overview

Service providers' networks support 3GPP-defined user authentication and authorization. These capabilities could be used by application service providers (ASPs) and enterprises to authenticate users and grant them access to use their applications seamlessly and silently. This is done under the condition that the users are also subscribers to the service provider's network.

Challenge

Today a 2- factor authentication is often provided using one-time-passwords sent over SMS to the end-user. This SMS-OTP is not very safe (the SMS-OTP can be intercepted or tampered with) and the user experience is not optimal. In some UE’s it is a manual process to read the SMS, and type the OTP in the app, while some UE’s assist in this process.

Solution

Service providers can provide a simple and secure two factor authentication to application service providers (ASPs), replacing SMS one-time-passwords. Service provider assets (such as IP connection and the known subscriber identity) provide a secure second factor authentication. Alternatively, the smartphone’s secure entitlement channel has very high security standards using SIM card authentication.

The end user logs in to an app using their username and password.
Two-factor authentication can be performed with the click of a button through a network-verified phone number.
The network authenticates the end user via the secure entitlement channel and the cellular IP knowledge.
The end user is able to access the desired service.

The main target segment for this use case is the enterprise segment, with any application requiring an authentication (for example banks and entertainment)

Business models

Service providers can monetize based on three different models:

Wholesale (towards the aggregator)
Subscription (towards the subscriber)
Pay-per-use (towards the enterprise)

APIs in use

NumberVerify