SMS authentication is one of the most common real name authentication methods in Authentication & Billing systems. Logically simple.——Users enter a cell phone number, receive the authentication code and access to the Internet when completed. But when actually deployed, text messages certify that there are many pits in this area, ranging from operator access to compliance requirements to cost control, each of which may be problematic.
The first real problem is the stability of the text-message channel itself.. The authentication code text message is a channel for text messaging service providers, not ordinary text messages, and the quality and reliability of services vary depending on the provider."Could not get the authentication code."The filtering rules for SMS are not regularly adjusted by major operators, especially certain keywords or blocks that may trigger interception. This problem is highly expensive to check because the system log shows text messages have been sent, but the user phone is seized and requires a check of delivery records on the side of the service provider to confirm it.
The second problem is the security design of the authentication code.Some networks, Authentication & Billing, have long or no requested frequency limits and may be subject to malicious script batch requests, resulting in abnormally high text message costs. The normal design should be that individual cell numbers can only request a limited number of times for a given period, the validity code does not exceed five minutes, and successive failures are locked for a certain period of time. If systems are free from these limitations, they are easily abused, and the cost of text messaging is an actual cost, not a virtual loss.
The third problem is the legal requirements of a real name match.The Ministry of Public Security requires visitors to WiFi and the public area network to be authenticated, so that the cell number is not fully authenticated by collecting a cell phone number."The cell phone number plus the three-point combination of ID numbers."function, the user types a cell number, identification number and name, the system calls a third-party interface to verify whether the three matches. This matching interface is paid separately, at cost for each query, not all of the manufacturers defaulted on it, sometimes requiring separate purchases. If there is a real name compliance requirement, this block must be identified during the procurement.
And there's a point that can be easily ignored in practice:Treatment of foreign usersForeign cell phones do not receive text messages in many systems, because domestic SMS channels have limited coverage of foreign numbers. If the scene has a guest reception requirement, such as an international hotel or a foreign campus, the system needs to be supplemented by other authentication methods, such as passport certification, mail certification or temporary account numbering from front office staff.
The budget for texting is also a business cost that can easily be missed.. The cost of each text message appears small, but the number of live users at peak periods or large locations is multiplied by tens to tens of thousands of dollars per month depending on the number of users and frequency of conversations. If a new text message is sent back to the network every time it is connected, the costs are further increased. A valid design is that after the first validation has been completed, the user will be given an exemption from authentication validity period for binding the MAC, such as automatic connection to the same device within 30 days without re-triggering the text message. This reduces the amount of text flow consumption in compliance.
The back-office management of text messages is also a matter of concern.. The administrator needs to see a record of text messaging, including numbers, time sent, status (success/failure), reasons for failure. This record is both the basis for checking problems and the material for compliance audits. It is difficult to trace if there is no complete SMS log in the system.
Text message authentication is easy, but not without cost. Putting the above questions out during the selection phase requires manufacturers to provide clear technical options and cost descriptions that would save a lot more than stepping on the pits.
The details of the user experience for text-letter authentication are worth grinding.. The content format, sender ' s name (signature), hint text directly affects the user ' s sense of trust and flow. Some systems send hard-coded messages or have an irregular signature that is easily blocked by users as spam. SMS signatures require advance notification and clearance to operators, usually for several working days, not on-line applications.
In a scene where multiple authentications coexist, the design of the guide to the certification portal is equally not negligible.. If the authentication page provides text message authentication, account password authentication and micro-credit authentication simultaneously, users should know exactly what to choose from, rather than starting from where to start when faced with three portals. For temporary visitors, SMS certification is a minimum selection that should be recommended as default; for long-term users, it is easier to have an account number code or MAC exempt authentication. The design logic of the authentication entrance matches the user group profile, otherwise actual usage would be low even if there were functionality.
In a high frequency use scenario, text message authentication needs to be coupled with the decertification mechanism to reduce user frictionThe logical design is that after the first SMS certification has been successful, MAC will be given a period of time to release it from validation, such as 15 or 30 days, and then trigger a text message validation. This reduces user duplication and the cost of text messages by complying with a real name. The specific validity period is determined in accordance with the security requirements of the scene, and guest rooms may be short because of their mobility and long-term use of the campus.