Contactless Card OTP Authentication Using Cryptogram Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
One-time passcodes (OTPs) are susceptible to security risks when accessed by unauthorized users due to unsecured devices, allowing potential breaches of sensitive information.
Innovation Solution
A contactless card generates a cryptogram and URL, which are used to authenticate with a server, ensuring secure generation of OTPs through key diversification and decryption, verifying user identity and minimizing fraudulent access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP delivery methods are used, then OTPs can be sent to devices, but security is compromised when devices are left unlocked or accessed by malicious users
Solution Approach 1:
The patent introduces a contactless card as an intermediary physical object between the user and the OTP delivery system. The card contains a secure element that generates and stores cryptographic material, acting as a mediator that ensures OTPs are only delivered to authorized devices. This intermediary mechanism resolves the contradiction by adding a physical security layer that prevents unauthorized access even if the user's device is compromised.
Solution Approach 2:
The system performs preliminary authentication by verifying the contactless card before delivering any OTP. The card must present valid cryptographic proofs (such as challenge-response authentication) before the system will deliver an OTP to the associated device. This preliminary action ensures that only authorized devices receive OTPs, resolving the security concern of devices being left unlocked or accessed by malicious users.
2Reliability
If contactless card authentication is implemented, then OTP security is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complex cryptographic authentication logic from the user's device and relocates it to the contactless card itself. The card contains the secure element that generates cryptographic material and performs authentication, while the user's device only needs to read data from the card and transmit OTP requests. This extraction reduces the complexity burden on the user's device while maintaining high security.
Solution Approach 2:
The system uses cryptographic copies and hashes of the OTP and authentication data. Instead of storing the actual OTP on the card or in plain text on the device, the system uses encrypted copies and cryptographic hashes that can be verified without exposing the actual credentials. This copying approach maintains security while simplifying the implementation requirements.
3Reliability
If cryptographic verification steps are added, then fraud prevention is enhanced, but processing time increases
Solution Approach 1:
The contactless card performs preliminary cryptographic operations locally, including generating cryptographic material and performing challenge-response authentication before any network communication occurs. This preliminary action reduces the time required for subsequent OTP delivery and verification steps, as the heavy cryptographic computations are already completed or pre-computed on the card.
Solution Approach 2:
The system uses efficient cryptographic algorithms and optimized verification processes to rush through the authentication steps. The contactless card can present pre-computed cryptographic proofs or use lightweight verification algorithms that quickly validate authentication without requiring complex multi-step verification processes, thereby reducing overall authentication time while maintaining security.
Data Source
AI summary
Systems, methods, apparatuses, and computer-readable media for secure generation of one-time passcodes using a contactless card. In one example, an operating system (OS) of a device may receive a uniform resource locator (URL) and a cryptogram from a contactless card. The OS may launch an application associated with the URL. The application may transmit the cryptogram to an authentication server. The application may receive a decryption result from the authentication server indicating the authentication server decrypted the cryptogram. Based on the decryption result, the application may request an OTP. The processor may receive an OTP from an OTP generator. The application may receive an input value and compare the input value to a copy of the OTP. The application may determine that the comparison results in a match, and display, based on the determination that the comparison results in the match, one or more attributes of the account.