InstaMAuth: Instant Mobile Authentication Service Based on 5G Authenticated Call Sessions

Password-based authentication methods are common for Internet apps. They have been scaled by third-party authentication methods like OpenID Connect, which allow Internet apps to delegate user authentication to a trusted third party. However, they share the same drawbacks, including security vulnerabilities and the inconvenience of periodic password changes, complexity requirements, and manual input. Given that nearly every user has a smartphone that is authenticated by the mobile network and always connected, it raises the question: can this smartphone be used as a token for third-party authentication through the mobile network, avoiding the need to memorize passwords and input user credentials? In this paper, we leverage this idea to introduce Instant Mobile Authentication (InstaMAuth), a new third-party authentication solution based on the smartphone's authenticated call session, which is always on and ready for use. It supports not only smartphone apps but also apps on non-smartphone devices through Bluetooth, while addressing the scalability issue caused by limited call session resources. Evaluation results from the InstaMAuth prototype over an operational 5G mobile network confirm its effectiveness, showing it can outperform other authentication methods, including password-based and Google-based, with up to 66.1% and 61.1% smaller login delays, respectively.