Contactless Card Authentication Using Non-Monotonic One-Time Passwords

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing contactless cards face challenges in data security, authentication, and verification, with vulnerabilities in email and SMS verification methods, and reliance on log-in credentials compromising account access, necessitating improved cryptographic authentication and activation processes.

Innovation Solution

Implementing a contactless card with processors, memory, and cryptographic algorithms to generate non-monotonic one-time passwords, using a counter that increments or decrements to create cryptograms and transmit secure passwords, ensuring secure communication with client devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional verification methods (email, SMS, log-in credentials) are used, then card activation and authentication can be performed, but the system is vulnerable to hacking, unauthorized access, and security compromises

Engineering Contradiction:

Improveauthentication securityVSAvoidvulnerability to hacking and unauthorized access

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary cryptographic key establishment and counter initialization during card provisioning, so that secure one-time password generation is already in place before the card is activated or used. This preliminary setup ensures that when authentication is needed, secure cryptographic mechanisms are already operational, eliminating the need for vulnerable post-activation verification methods.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements dynamic one-time passwords that change with each transaction through counter-based cryptographic generation. Unlike static credentials, these passwords are dynamically generated using cryptographic algorithms and counters, ensuring that each authentication event uses a unique, unpredictable value that cannot be reused or guessed by attackers.

Inventive Principle:

Principle #15Dynamics

2Reliability

If cryptographic authentication with counters is implemented, then security is improved, but the device complexity increases due to processors, memory, and cryptographic algorithms

Engineering Contradiction:

Improvedata securityVSAvoidcryptographic processing components

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The contactless card is segmented into distinct functional components: a processor for cryptographic operations, memory for storing counters and keys, and communication interfaces. This segmentation allows each component to be optimized independently and facilitates modular implementation of cryptographic protocols without requiring the entire system to be redesigned.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The contactless card performs self-service cryptographic operations by generating its own one-time passwords using internal counters and cryptographic algorithms. The card autonomously manages its authentication credentials without requiring external key management infrastructure or continuous connection to authentication servers, reducing overall system complexity while maintaining security.

Inventive Principle:

Principle #25Self-service

3Object-affected harmful factors

If one-time passwords with non-monotonic counters are used, then unauthorized access is hindered, but the difficulty of detecting and measuring authentication states increases

Engineering Contradiction:

Improveability to guess or generalize authentication informationVSAvoidauthentication state verification

Core Design Contradiction:

Object-affected harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The patent employs asymmetric cryptographic operations where the card generates one-time passwords using cryptographic algorithms applied to counter values. The authentication verification relies on cryptographic proof rather than direct counter value comparison, creating an asymmetric relationship between password generation (simple counter increment) and verification (cryptographic validation), which protects the counter state from direct observation.

Inventive Principle:

Principle #4Asymmetry

Solution Approach 2:

Cryptographic algorithms serve as intermediaries between the counter state and the authentication verification process. Instead of directly exposing or comparing counter values, the cryptographic functions transform counter states into one-time passwords and verify them through cryptographic validation, acting as an intermediary layer that protects the underlying counter mechanism from direct detection or measurement.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12494915B2Systems and methods for cryptographic authentication of contactless cards

Publication Date: 2025.12.09 CAPITAL ONE SERVICES LLC

AI summary

Example embodiments of systems and methods for data transmission between contactless card and receiving devices are provided. In an embodiment, the contactless card may be configured to create a cryptogram based on a plurality of keys and a counter. The cryptogram may be transmitted to the receiving device. The contactless card may be configured to transmit a one-time password to the client device. The counter value may be adjusted each time the one-time password is generated, and the counter may be configured to increment in a non-monotonic sequence, the sequence associated with one or more cryptographic algorithms.