Access Card PIN Reset via Server Authentication on Non-Secure Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current strong authentication mechanisms, such as Public Key Infrastructure (PKI), are expensive and complex, making them unfeasible for many entities, and existing systems cannot securely reset a PIN on access cards without a master key, limiting the use of 2-Factor authentication in entry-level systems.
Innovation Solution
A method for resetting a PIN on an access card using a server authentication public key and private key, allowing secure PIN reset over a non-secure channel by verifying the server's authenticity through a challenge-response mechanism, eliminating the need for a master key and reducing deployment complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strong authentication mechanisms like PKI are implemented, then authentication security is improved, but deployment cost and complexity increase significantly
Solution Approach 1:
The patent extracts the essential authentication functionality from the complex PKI framework by implementing a simplified challenge-response mechanism using card-unique identifiers and server-authenticated sessions. This allows strong authentication without the full overhead of PKI infrastructure, certificates, and key management systems.
Solution Approach 2:
The patent uses disposable, short-lived session keys and temporary authentication tokens instead of long-term digital certificates. Each authentication session generates new cryptographic materials that are discarded after use, eliminating the need for complex certificate lifecycle management while maintaining security.
2Reliability
If a master key is required for PIN reset operations, then security is improved, but system accessibility and ease of operation deteriorate
Solution Approach 1:
The patent introduces an intermediary authentication mechanism using card-unique identifiers and server-authenticated sessions as a mediator between the user and the PIN reset function. This allows secure PIN reset without direct master key involvement, making the system accessible to entry-level cards while maintaining security through the intermediary authentication protocol.
3Reliability
If secure channels are required for privileged operations, then security is improved, but adaptability to non-secure environments deteriorates
Solution Approach 1:
The patent inverts the traditional approach by establishing server-authenticated sessions over non-secure channels first, then using these sessions to securely perform privileged operations. Instead of requiring a secure channel to establish authentication, the authentication itself creates the secure context, allowing entry-level cards to operate in non-secure environments while maintaining security for privileged operations.
Data Source
AI summary
A method for resetting a pin on an access card is disclosed. The method includes generating a server authentication (SA) public key and an SA private key and attempting a write of the SA public key to the access card over a non-secure channel. The method further includes determining if the access card currently contains an existing SA public key. The attempted write of the SA public key is handled by one of: (i) completing the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the access card did not contain an existing public key; (ii) denying the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the existing SA public key matches the SA public key that is attempted by the write; and (iii) denying the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the existing SA public key does not match the SA public key that is attempted by the write.