Contactless Card Cryptographic Authentication via Diversified Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic authentication methods for contactless cards are vulnerable to hacking and compromise, lacking robust security for data protection and user verification, especially in electronic transactions.
Innovation Solution
A system and method utilizing a contactless card with a processor and memory, employing cryptographic algorithms to generate and manage diversified keys, encrypt data, and validate user identification through NFC technology, ensuring secure communication and operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic algorithms (e.g., triple DES) are used for authentication, then data encryption is provided, but the system remains vulnerable to hacking and unauthorized access
Solution Approach 1:
The patent changes the cryptographic parameters by implementing a challenge-response authentication mechanism where the authentication server generates a random challenge value that is combined with the user's password through a cryptographic hash function. This dynamic parameter change ensures that each authentication attempt uses a unique key derivation, making traditional hacking methods ineffective.
Solution Approach 2:
The system performs preliminary cryptographic key derivation before the actual authentication exchange. The authentication server pre-computes a cryptographic hash of the challenge value combined with the password, and this pre-computed key is then used to encrypt the challenge-response message. This preliminary action ensures that even if the encrypted message is intercepted, the key cannot be easily derived without knowing the original password.
2Productivity
If contactless card technology is used for transactions, then transaction speed is improved, but security vulnerabilities increase compared to chip-based cards
Solution Approach 1:
The patent introduces an authentication server as an intermediary between the contactless card and the transaction system. The card contains only a cryptographic module that communicates with the authentication server through secure challenge-response exchanges. This intermediary architecture allows the contactless card to maintain its speed advantage while delegating the heavy cryptographic verification to the server, thereby improving security without sacrificing transaction speed.
Solution Approach 2:
The authentication system is segmented into two parts: a lightweight cryptographic module in the contactless card for generating and verifying challenges, and a more powerful authentication server for key management and password verification. This segmentation allows the card to remain simple and fast while the server handles the complex security requirements.
3Reliability
If log-in credentials (username and password) are used for account access, then authentication is provided, but access can be compromised if credentials are stolen
Solution Approach 1:
The system performs preliminary cryptographic hash computation of the password combined with a challenge value before any authentication exchange occurs. This pre-computed hash serves as a one-time key that is used only for that specific authentication attempt. Even if an attacker intercepts the authentication messages, they cannot reuse the credentials because the key is derived dynamically from the challenge value, which changes with each authentication attempt.
Solution Approach 2:
The authentication key is designed as a disposable, short-lived cryptographic object that exists only for the duration of a single authentication attempt. After the challenge-response exchange is complete, the key becomes obsolete and is discarded. This eliminates the risk of credential compromise because there are no long-lived credentials to steal or reuse.
Data Source
AI summary
Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.