On-Device Biometric Authentication for Secure Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current transaction authentication methods, such as the 3-D Secure Protocol, rely on PINs and lack additional security layers, making them vulnerable to fraud, especially in online transactions, and do not effectively utilize consumer mobile devices for enhanced authentication.
Innovation Solution
Implementing a secure cardholder authentication process using consumer mobile devices to capture and compare biometric data, such as fingerprints, facial recognition, and voice biometrics, against locally stored templates, providing multi-factor authentication and reducing the risk of unauthorized transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional PIN-based authentication is used, then ease of operation is maintained, but security reliability is insufficient
Solution Approach 1:
The authentication process is segmented into multiple independent factors: something the user knows (PIN), something the user has (mobile device), and something the user is (biometric data). Each factor operates independently but contributes to the overall authentication decision, allowing the system to maintain ease of operation for each individual factor while achieving high security through their combination.
Solution Approach 2:
The system transitions from two-dimensional authentication (PIN only) to three-dimensional authentication by adding biometric verification as a new dimension. This additional dimension of verification perpendicular to the traditional PIN-based approach creates a more robust authentication space that simultaneously maintains user convenience and enhances security reliability.
2Reliability
If multi-factor authentication with biometric data is implemented, then security reliability is improved, but device complexity increases
Solution Approach 1:
The mobile device performs self-service by capturing biometric data, comparing it against stored templates, and making authentication decisions locally without requiring complex external verification infrastructure. The device's existing biometric sensors and processing capabilities are leveraged to provide multi-factor authentication, reducing the need for additional complex system components.
Solution Approach 2:
The system merges multiple authentication factors (PIN verification, device possession validation, and biometric matching) into a unified authentication flow that is managed by a single authentication module. This consolidation reduces overall system complexity by integrating rather than separately managing each authentication component.
3Productivity
If biometric data is captured and stored locally on mobile device, then authentication speed is improved, but security risks increase
Solution Approach 1:
Biometric templates are stored in a dedicated secure storage area within the mobile device, physically and logically separated from the main file system and application memory. This localized secure storage with restricted access permissions protects the biometric data while allowing rapid retrieval for authentication comparisons, maintaining both security and speed.
Solution Approach 2:
The system extracts only the essential biometric template data (mathematical representations of biometric features) from the actual biometric images, storing only these compressed templates locally while keeping the original biometric data secure. This extraction reduces the attack surface for potential breaches while maintaining authentication functionality.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A secure on-device cardholder authentication method and system. In an embodiment, a consumer's mobile device uses a mobile application to receive a user authentication request from an entity. A biometric data capture request is then transmitted to a biometric sensor of the mobile device, and a determination made that the mobile application is authorized to use an authenticator API. Next, the mobile device processor prompts the user to provide at least one form of biometric data in accordance with business rules, receives a user authentication response when the user provided biometric data matches locally stored biometric data, generates a positive user authentication response message, and transmits the positive user authentication response message to the entity.