Contactless Smart Card Authentication Using Mobile Token Provisioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Unauthorized users can activate mobile pay services on their devices using stolen or lost payment cards by accessing the card information, leading to unauthorized purchases.
Innovation Solution
A system that uses a mobile device to authenticate a smart card through a contactless chip, generating and managing tokens to securely enable transactions without physical card presence, involving a card issuer computing system, token provisioning logic, and mobile pay circuit to manage and authenticate payment card applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If payment card information is made accessible on the mobile device for mobile pay functionality, then ease of operation is improved, but security is worsened due to risk of unauthorized access
Solution Approach 1:
The patent introduces a token as an intermediary between the payment card information and the mobile device. The token provisioning logic generates and manages tokens that represent the payment card information without storing the actual card details on the mobile device. This intermediary mechanism allows mobile pay functionality to operate while maintaining security, as the token can be used for transactions without exposing the underlying payment card information.
Solution Approach 2:
The patent extracts the sensitive payment card information from the mobile device by using tokenization. Instead of storing actual payment card data on the mobile device, the system extracts only the necessary transaction authorization capability through tokens. The real payment card information remains secured on the card issuer's systems, separating the mobile device's role to merely holding and presenting tokens for authentication.
2Ease of operation
If payment card information is stored on the mobile device, then ease of operation is improved, but loss of information risk increases
Solution Approach 1:
The token acts as an intermediary that replaces the need to store actual payment card information on the mobile device. The token provisioning logic manages tokens that can be used for transactions without containing or exposing the real payment card data. This intermediary layer ensures that even if the mobile device is lost or hacked, the actual payment card information remains secure.
Solution Approach 2:
The patent extracts the essential functionality of payment card information (transaction authorization capability) from the actual sensitive data. By using tokens that represent payment cards without storing the real card information on the mobile device, the system removes the risk of information loss while maintaining ease of operation for legitimate users.
3Reliability
If a comprehensive authentication system is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The token provisioning logic serves as an intermediary layer that simplifies the authentication system architecture. Instead of implementing complex authentication mechanisms directly on the mobile device, the system uses tokens as mediators that encapsulate authentication credentials. This allows the card issuer to manage authentication complexity centrally while the mobile device simply needs to store and present tokens, reducing overall system complexity.
Solution Approach 2:
The patent extracts authentication complexity from the mobile device by centralizing it in the token provisioning logic. The mobile device's role is simplified to storing and presenting tokens, while the complex authentication and verification processes occur on the card issuer's systems. This extraction reduces the complexity burden on the mobile device while maintaining strong authentication security.
Data Source
AI summary
Systems, methods, and computer-readable storage media of activating a card having a contactless chip are provided. One method includes receiving, from a mobile device via a wireless transmission from the card having the contactless chip to the mobile device, a cryptogram, and decrypting the cryptogram to reveal information. The method further includes comparing the revealed information regarding at least one of the card or the user to information in a customer database, confirming the revealed information, and updating the customer database to indicate that the revealed information regarding the at least one of the card or the user is confirmed. The method further includes activating the card for an initial card transaction based on updating the customer database, and providing, to the mobile device, a payment card token associated with the card as part of a mobile wallet transaction using the mobile device involving the card.