Secure Transaction System Using Chip Card Reader Session Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure transaction systems over communication networks, such as the Internet, are vulnerable to attacks like social engineering, phishing, and man-in-the-middle attacks due to reliance on insecure certificate-based protocols and the lack of user verification, making them susceptible to fraud and data breaches.
Innovation Solution
A secure online transaction system that uses a chip card reader and a security module to generate a session key for encrypting transaction data, leveraging symmetric encryption keys stored on secure smart cards, which are resistant to social engineering attacks and provide strong authentication between the card and the service provider's equipment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificate-based protocols (SSL/TLS) are used to secure transactions, then authentication is provided, but the system remains vulnerable to phishing and man-in-the-middle attacks due to lack of user verification
Solution Approach 1:
The patent introduces a card reader as an intermediary device between the user's card and the terminal. This reader verifies the card's authenticity by reading data directly from the card chip and comparing it with expected values, preventing phishing attacks where fraudulent websites attempt to steal card information. The reader acts as a trusted mediator that ensures the card is genuine before allowing transaction proceeds.
Solution Approach 2:
The system performs preliminary verification of the card's authenticity before the actual transaction takes place. The card reader reads and validates card data (such as verifying the relationship between card number and security code) in advance, ensuring that only authentic cards can proceed with transactions. This preliminary action prevents fraudulent transactions initiated by phishing attacks.
2Reliability
If symmetric encryption keys are stored on secure smart cards, then strong authentication is achieved, but the system complexity increases due to key management requirements
Solution Approach 1:
The smart card itself performs the authentication function by verifying the relationship between stored data elements (e.g., checking if the security code matches the card number according to a predetermined algorithm). The card autonomously generates authentication responses without requiring external key management infrastructure. This self-service approach simplifies the overall system while maintaining strong authentication.
Solution Approach 2:
The smart card serves multiple functions: it stores authentication credentials, performs cryptographic operations, and validates its own authenticity. By consolidating these functions into a single universal device, the system avoids the need for separate key management infrastructure, reducing overall system complexity while maintaining security.
3Object-affected harmful factors
If user verification mechanisms are implemented, then security against social engineering attacks improves, but ease of operation decreases due to additional verification steps
Solution Approach 1:
The verification function is extracted from the terminal software and implemented in dedicated hardware (the card reader). This separation allows the verification process to be transparent and automatic, requiring minimal user intervention. The user simply inserts the card, and the reader automatically performs the security verification, maintaining ease of operation while providing strong protection against social engineering attacks.
4Reliability
If session keys are generated for each transaction, then data confidentiality is improved, but processing time increases due to key generation overhead
Solution Approach 1:
The card reader generates and stores session keys in advance, before actual transactions occur. When a transaction is initiated, the pre-generated session key is immediately available for use, eliminating the time-consuming key generation process during the transaction itself. This preliminary preparation maintains strong data confidentiality while minimizing processing time impact.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The system has a smart card reader (1) with processing units (12) for exchanging data representing transaction, with a chip (20) of a secured card (2) e.g. bank card, to obtain public data (D-chip) from the chip and transmit the public data to a safety module (41) and generating a session key (Kses) in cooperation with the card. The module determines the session key from the public data and an encrypting key (CF). The reader and the module establish a secured communication channel (CS) by encrypting and decrypting the data relating to transaction, passing via the channel, by the session key. An independent claim is also included for a method for secure on-line transaction over a communication network.