Card Payment Authentication with Blockchain Token Hashes Against OTP Diversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication systems for card-based transactions, such as two-factor authentication via SMS-based OTPs, are vulnerable to unauthorized access due to potential diversion of OTPs to attacker devices, leading to unauthorized transactions.
Innovation Solution
Implementing a multi-factor authentication system that uses a blockchain token hash combined with a one-time passcode (OTP) to generate a security key, where the blockchain token hash is stored across multiple card networks, ensuring that both the OTP and the blockchain token hash must match for transaction approval, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OTP-based two-factor authentication is used for card transactions, then user authentication is improved, but the system becomes vulnerable to OTP diversion attacks
Solution Approach 1:
The authentication process is segmented into multiple independent verification stages: first verifying the OTP received by the user device, then separately verifying the blockchain token hash stored on the card network. Both segments must be valid for transaction approval, preventing single-point compromise attacks
Solution Approach 2:
The blockchain token hash acts as an intermediary verification layer between the OTP authentication and final transaction approval. The payment gateway device mediates by comparing both the OTP and blockchain token hash before authorizing transactions, adding a trusted third-party verification mechanism
2Reliability
If blockchain token hash verification is added to authentication, then security against unauthorized transactions is improved, but system complexity increases
Solution Approach 1:
The blockchain token hash serves multiple functions: it acts as a unique identifier for the payment card, a security verification element, and a transaction authorization component. This multi-functionality reduces the need for separate systems while enhancing security
Solution Approach 2:
The blockchain token hash is pre-stored and registered on the card network before the transaction occurs. This preliminary setup allows for rapid verification during transactions without adding real-time computational complexity, as the hash is already available for comparison
3Object-affected harmful factors
If both OTP and blockchain token hash must match for approval, then unauthorized transaction prevention is improved, but processing time increases
Solution Approach 1:
The blockchain token hash is pre-computed and stored on the card network during card issuance and registration. During transaction processing, the system only needs to retrieve and compare the pre-existing hash with the one provided by the user device, avoiding time-consuming computations and minimizing processing delays
Data Source
AI summary
Aspects of the disclosure relate to multi-factor user authentication for card-based payment transactions using blockchain tokens. An computing platform may receive, from a computing device, transaction details associated with a card-based payment transaction corresponding to a user, wherein the transaction details comprise a card number of a payment card. The computing platform may determine, based on the card number, a user device associated with the user. The computing platform may send, to the user device, a one-time passcode (OTP). After sending the OTP, the computing platform may receive a security key. The security key may be generated based on the sent OTP and a blockchain token hash. The computing platform may, based on the received security key, send, to the computing device, a message indicating whether the transaction is approved or declined.