"SSenStone's technology is not an incremental refinement of solutions that existed in other countries. We aim to become the first company from South Korea to establish a foundational security technology used across the global market."

These are the words of Chang-hun Yoo, chief executive officer of SSenStone. SSenStone is targeting the operational technology (OT) security market with its proprietary One-Time Authentication Code (OTAC) technology, a world-first solution developed in-house.

Founded in 2015 as an authentication security startup, SSenStone spent its first three years offering a "two-way dynamic token" service that generated and received tokens back and forth between clients and servers. The company subsequently developed OTAC to overcome the structural limitations of two-way dynamic tokens, particularly their heavy reliance on network connectivity.

Two-way dynamic tokens are already familiar to most people in everyday life—quick response (QR) codes widely used during the COVID-19 pandemic are a prime example. Users would shake their smartphone to generate a QR code, which connected to a server to request authentication. Recognizing the generated QR code within a specified time window and sending the signal back constitutes a two-way dynamic token.

In contrast, OTAC enables identification and authentication simply by transmitting a generated code based on a pre-registered unique key to a server. The code changes with every use, and identical codes are never generated under any circumstance. This unique OTAC value alone allows systems to identify users or devices without requiring static inputs like user IDs or passwords.

Q&A

Q: Hello, today we are joined by Chang-hun Yoo, CEO of SSenStone. You mentioned the company name translates to "strong stone" in Korean. Could you briefly introduce SSenStone?

A: SSenStone started in November 2015 as an authentication security startup. For the first three years, we operated using two-way dynamic tokens. After three years, we developed our foundational technology called OTAC—One-Time Authentication Code—which is a unidirectional dynamic token technology unprecedented globally. In December 2018, we established a wholly owned global headquarters in the UK called swIDch. The UK government invited us through a program that included visa sponsorship capabilities.

Q: Could you elaborate on your proprietary technology, One-Time Authentication Code?

A: People already use one-time codes today, such as One-Time Passwords (OTP). But a password alone cannot identify a user; you still need a user ID first to know who the person is before applying the password. That is why OTP can only serve as a second factor for authentication. If you send only an OTP to a system without an ID, the system has no way of knowing who you are. Many security professionals are unaware of this structural limitation. When we suggested that identification and authentication could be accomplished with a unidirectional dynamic token, the global industry initially claimed it was impossible. But after more than a year of R&D, we found the solution.

Q: Could you explain the concept of unidirectional authentication in more detail?

A: Think of this mouse on the desk as a mobile phone. We experienced dynamic tokens frequently during COVID-19 with QR check-ins. You used your phone, a QR code appeared, you scanned it at a shop, and you were authenticated. That was a dynamic token, but it was two-way. The QR code was not created entirely on your phone; when you shook your device, a request was sent to service providers like Naver or Kakao. Their servers generated a code valid for three minutes and sent it back to your phone, which displayed it as a QR code to be scanned and routed back to the server within three minutes. On a device without communication capabilities, if a code keeps changing and you send it out, the server cannot know who is sending it. Before OTAC, authentication required the server to generate and send the code, which then had to return within a set timeframe.

Our unidirectional dynamic token technology works even in client environments without communication capabilities—even inside a tiny smart card chip—generating ever-changing codes that uniquely identify the user, command, or device without overlap.

Q: It is hard to grasp how that is possible. Could you explain the mechanism again?

A: What I have in my hand is a non-communicating smart card. This actual device is currently used by Korea Water Resources Corporation (K-water) and LG Energy Solution. Employees cannot bring mobile phones into factory floors, so they use OTAC codes instead of IDs, passwords, and OTPs.

When you press a button on the card, it prompts for a PIN, providing multi-factor authentication (MFA). Even if I hand this card to you, you cannot use it without knowing my PIN. Once the PIN is verified and you press OK, an 8-character alphanumeric code appears at the bottom. These eight characters replace my ID, password, and OTP. When entered, our system algorithm recognizes who I am and verifies the OTP simultaneously. It sounds improbable, doesn't it?

Q: How exactly does that single 8-character code accomplish all of that?

A: Security experts and academics worldwide believed one-way dynamic identification and authentication was mathematically impossible. When we began R&D, even SSenStone's head of research initially declined to work on it. I ended up working on it alone at first. Fortunately, because my background was not in computer science or cryptography, I had never learned why it couldn't be done—I simply didn't know the reasons it was supposed to fail. After failing for over a year, I almost gave up, thinking, "This must be a geometric structure, but it doesn't work in our current dimensional framework." While walking along the Han River, a scene from the movie Interstellar came to mind—the moment near the end where the protagonist wakes up in a hospital on a space station and sees a baseball game outside, where a hit ball smashes a window on a house hanging upside down. I realized: the XYZ axes are not straight lines; they are curved into a circle.

We started from that circular structure. The result was "continually shifting coordinates." What is generated is a coordinate that changes constantly, yet every time it drops a point, it consistently maps to my designated position. When another person generates a code, a completely different, non-overlapping coordinate appears, yet it maps consistently to that person's location. When we announced this solution, it was not immediately recognized in South Korea. We sought validation overseas, and a faculty team at the University of Surrey's cybersecurity lab in the UK mathematically verified our technology. That verification allowed us to bring the technology back to the global market.

Q: That sounds like a significant breakthrough.

A: I agree, but it is not yet widely known globally, which is why we are actively promoting it while securing major investments.

Q: Network-level information interception is one of the most common cyber threats. Does your technology mean stolen network information becomes useless?

A: Precisely. Cryptography is about making stolen data useless to an interceptor. If you write "Chang-hun Yoo" on a sticky note and pass it along, anyone who intercepts it knows the name. Encryption obfuscates the name into code so the recipient needs a key or decryption program to reconstruct "Chang-hun Yoo." However, hackers can still infer where the data came from or deduce that it is an ID and password used for login. Even with static obfuscation, vulnerabilities remain. OTAC continuously changes the token. Even if a hacker intercepts and decrypts the data, the valid timeframe—whether 30 seconds or three minutes—has already expired, rendering the decrypted data useless.

Q: What are the primary practical advantages of unidirectional technology?

A: Indonesia was among the first to adopt this technology, embedding it into their "e-Stamp" tax collection system. If you assign sequential serial numbers to tax transactions, patterns emerge that could allow forgery. They chose our technology because it generates continuous, non-sequential codes with zero discernible patterns.

Another case involves high-volume online services. In South Korea, when millions of citizens access the National Tax Service website simultaneously for year-end tax settlements, systems experience heavy congestion. Handling such traffic with traditional two-way tokens requires massive server infrastructure because servers must hold open requests while waiting for user responses. With OTAC, the server remains passive until a client device generates and sends a unique dynamic code, allowing instant identification without consuming massive server holding capacity.

Our current core focus is operational technology (OT) security. OT environments differ significantly from IT. While IT relies on robust two-way networks, OT restricts network environments, favoring air-gapped networks and unidirectional flows to prevent unauthorized access or control.

In OT environments, endpoint devices—such as Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), Distributed Control Systems (DCS), and Human-Machine Interfaces (HMIs)—cannot easily support multi-factor authentication. Managing passwords across thousands of PLCs is impractical, and standards requiring regular password changes are difficult to enforce. Standard FIDO biometric authentication also fails because it demands active two-way communications. In these constrained environments, our clients use OTAC to authenticate access to equipment securely.

Q: Such as access control in sensitive facilities like semiconductor fabrication plants?

A: Exactly—preventing unauthorized access to critical equipment. In geopolitical conflicts, cyberattacks increasingly target OT and industrial infrastructure rather than just IT systems because the impact is immediate and physical. In traditional OT setups, once an attacker breaches the boundary network between IT and OT, internal systems are often unprotected. With OTAC, even if an attacker crosses that boundary, they cannot execute operational commands without generating the required dynamic code.

Some ask whether focusing on air-gapped, unidirectional OT environments limits our scalability. In fact, the opposite is true—the recent issue around Claude Mythos has actually worked in our favor. AI agents can now identify and exploit vulnerabilities at unprecedented speeds. Whether an attack originates from a human or an AI, the AI cannot generate an OTAC code, blocking unauthorized execution. This capability attracted investment from Hyundai Motor Group during our recent funding round.

Looking ahead, Anthropic published a report titled "Zero Trust for AI Agents" on May 27, which recommends using hardware-bound keys to prevent software-based key theft by AI agents, as well as short-lived expiring tokens. Traditional Public Key Infrastructure (PKI) or symmetric algorithms struggle to generate short-lived tokens without continuous two-way communication or challenge-response exchanges. OTAC natively generates dynamic credentials from hardware-bound keys without needing continuous two-way networks, making it a critical future-proof architecture for the AI era.

Q: Will traditional two-way security communication methods eventually disappear?

A: No, two-way security will remain necessary. However, environments where two-way communication is restricted or impractical will become increasingly prevalent.

Q: And in those restricted environments, unidirectional authentication becomes essential?

A: Whenever short-lived tokens are needed in unidirectional environments, our technology serves as the core solution.

Q: Could you share details regarding your financial performance and client traction?

A: SSenStone recently passed its 10th anniversary since founding in November 2015. During our first four years, we operated comfortably with around 10 employees, generating over 2 billion won in revenue. After developing OTAC and securing Series A funding, we shifted focus toward refining our business model rather than aggressive short-term sales.

After revenue bottomed out, license-based tech revenues began climbing steadily last year. Key commercial deployments include Korea Water Resources Corporation (K-water) and LG Energy Solution.

Q: Could you mention other corporate clients?

A: I can confirm contracted partners, though companies currently conducting proof-of-concept (PoC) evaluations cannot be named yet. Most are major domestic conglomerates and global corporations, with two to three international firms currently conducting in-house PoC trials.

Q: Company materials also list Bithumb as a client?

A: That deployment uses our legacy authentication solution, which was awarded through standard competitive bidding. The newer prospects I mentioned are specifically evaluating OTAC for advanced OT integration.

Q: Does establishing your UK headquarters signal an aggressive expansion into European markets?

A: Establishing our UK entity, swIDch, was driven less by the local UK market alone and more by our desire to build a global headquarters outside Korea. South Korea is not as widely recognized in global cybersecurity as it is in cultural industries. Initially, outreach attempts originating from South Korea received limited responses from international enterprises. Today, all our global business outreach across Europe, the US, and Asia is conducted through swIDch in the UK. The UK government offered attractive incentives, including visa sponsorship and official recognition as a UK company while maintaining its role as global HQ.

Q: Are team members permanently stationed at the UK office?

A: We maintained local staff in the UK until early last year while establishing our core tech partnerships. Now that our product maturity and commercial references are established, meetings arranged through our UK headquarters can be effectively conducted by our team operating out of South Korea, allowing us to streamline international operational costs.

Q: What are your prospects regarding the Middle Eastern market?

A: The Middle East represents a significant market opportunity. Currently, we are engaging with partners across Taiwan, the United States, France, Japan, and the Middle East without limiting ourselves to specific geographic boundaries.

Q: What is your long-term outlook for SSenStone?

A: During the years spent developing the business model for OTAC technology, many expressed skepticism. I persevered because I remained fully confident in the technology, which market research firm Gartner has also highlighted as a next-generation authentication architecture.

SSenStone's ultimate goal is to stand as a premier holder of foundational cybersecurity technology from South Korea. Rather than modifying existing foreign solutions, we intend to be recognized as the company that created the first original Korean security technology widely adopted across the global cybersecurity market.