Biometric Payment Authentication Using Secure Key Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional biometric payment devices face security vulnerabilities due to simple mapping relationship authentication, which can be exploited by malicious devices mimicking genuine devices, compromising user fund account security.
Innovation Solution
A biometric payment device generates a key pair, with a public key uploaded to a payment authentication server and a private key used to sign device information, ensuring authentication through a secure link established by the server verifying the signature, using secure elements, trusted execution environments, or dynamic link library files to prevent key duplication and tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If simple mapping relationship authentication is used for biometric payment devices, then the authentication process is simple and easy to implement, but the security performance deteriorates because malicious devices can impersonate genuine devices by migrating device codes and signatures
Solution Approach 1:
The authentication system is segmented into multiple independent components: device information collection module, signature generation module (using secure elements or TEE), authentication request transmission module, and server-side verification module. This segmentation allows each component to perform its specific function securely, preventing impersonation while maintaining operational simplicity.
Solution Approach 2:
The patent implements asymmetric authentication where the device signs authentication requests with a private key stored in secure elements or TEE, and the server verifies using corresponding public keys. This asymmetric cryptographic approach ensures that even if device information is transmitted, malicious devices cannot generate valid signatures without the private key, thus preventing impersonation while keeping the authentication process simple.
2Ease of manufacture
If device codes and signatures are stored in system properties for authentication, then the authentication implementation is straightforward, but the security deteriorates because these credentials can be easily migrated to malicious devices
Solution Approach 1:
The patent implements preliminary action by pre-configuring secure elements or TEE in the device before authentication occurs. These secure environments are established during device manufacturing or initialization, ensuring that private keys and sensitive credentials are generated and stored in a tamper-resistant manner before any authentication transaction takes place, preventing credential migration to malicious devices.
Solution Approach 2:
The patent introduces secure elements or TEE as intermediaries between the application layer and the hardware layer. These intermediaries act as trusted mediators that securely store private keys and perform cryptographic operations, isolating sensitive credentials from the main system memory and preventing their extraction or migration to malicious devices, while still enabling straightforward authentication implementation.
3Device complexity
If conventional signature verification is used where the server verifies device information, then the authentication process is simple, but the security performance deteriorates because it cannot prevent device impersonation
Solution Approach 1:
The patent replaces the conventional mechanical/authentication system (comparing device codes and signatures) with a cryptographic system based on public key infrastructure. Instead of mechanically verifying stored credentials, the server uses cryptographic verification of digital signatures generated by the device's private key, providing strong identity verification while maintaining relatively simple system complexity through standardized cryptographic protocols.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
An authentication method of a biometric payment device includes: acquiring a key of the biometric payment device, the key being recognized by a payment authentication server and acquired through communication between a manufacturer device and the payment authentication server during a production phase; generating a signature according to the key and device information; transmitting an authentication request to the payment authentication server based on the device information and the signature, the authentication request instructing the payment authentication server to verify the signature according to the device information, and generate an authentication result of the biometric payment device according to a verification result; and receiving the authentication result returned by the payment authentication server, the authentication result causing the payment authentication server to perform a biometric payment based on biometric data transmitted by the authenticated biometric payment device.