Contactless Card Authentication Using Multi-Device FIDO Key Pairs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing card-based operations face significant security risks due to data interception and unauthorized access, particularly in contactless card communications, which are vulnerable to man-in-the-middle attacks and resource-intensive encryption measures that hinder operational efficiency.
Innovation Solution
Implementing a system that uses Fast Identity Online (FIDO) key pair cryptographic authentication, where a processor generates and transmits instructions to retrieve and sign challenges using FIDO keys, with validation occurring on a second device, thereby securing communication and reducing computational burden on the authenticator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to protect card communications from interception, then security is improved, but system resources are consumed and operational efficiency is hindered
Solution Approach 1:
The patent extracts the cryptographic key pair generation and storage function from the contactless card itself and relocates it to a secure authenticator device (mobile device). This extraction allows the card to perform only lightweight operations while the computationally intensive encryption and key management are offloaded to the more powerful authenticator, thereby improving operational efficiency while maintaining security
Solution Approach 2:
The patent introduces a secure authenticator device as an intermediary between the contactless card and the server. This intermediary handles the complex cryptographic operations and key pair management, allowing the card to communicate securely without burdening the card's limited processing resources, thus resolving the contradiction between security and operational efficiency
2Reliability
If traditional authentication methods are used, then access control is maintained, but sophisticated attacks such as man-in-the-middle attacks can succeed
Solution Approach 1:
The patent implements preliminary action by generating and storing unique key pairs in advance within secure authenticator devices before any communication occurs. These pre-generated keys enable the system to establish secure channels proactively, preventing man-in-the-middle attacks by ensuring that intercepted communications cannot be decrypted or manipulated without the corresponding private keys that remain secured in the authenticator
Solution Approach 2:
The patent changes the fundamental parameter of authentication from traditional static credentials (passwords, card numbers) to dynamic cryptographic key pairs that are uniquely generated for each user and device combination. This parameter change makes the system resistant to sophisticated attacks by ensuring that each authentication session uses unique, unguessable cryptographic parameters
3Reliability
If multiple key pair authenticators are implemented, then authentication security is enhanced, but device complexity increases
Solution Approach 1:
The patent applies universality by designing the secure authenticator as a multi-functional component that can operate across different contactless card systems and platforms. The authenticator handles multiple authentication scenarios (first and second authenticator modes), supports various communication protocols, and manages different key pair types, thereby enhancing authentication security without proportionally increasing complexity through standardized, versatile design
Data Source
AI summary
Systems and methods for authentication may include an authenticator. The authenticator may include a processor and a memory. The processor may be configured to: receive one or more challenges; generate a first instruction, the first instruction including a request to retrieve a first Fast Identity Online (FIDO) key; transmit the first instruction; receive the first FIDO key; sign the one or more challenges using the first FIDO key; and transmit one or more signed challenges for validation using a second FIDO key.