Contactless Transaction Security via Mutual Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Contactless payment services on mobile terminals using Host Card Emulation (HCE) are vulnerable to attacks, such as data theft and modification of the payment application logic, due to insufficient security measures compared to traditional security elements.
Innovation Solution
A method is introduced that involves a mobile terminal with a security module, which receives a session key from a contactless reader and a one-time password from a remote server, using a shared secret key, to establish a secure communication channel between the reader and the server, ensuring mutual authentication and integrity of data transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If sensitive data is stored on a remote server in cloud computing architecture, then security against attackers accessing the mobile terminal is improved, but vulnerability to data theft through stolen authentication data increases
Solution Approach 1:
The authentication process is segmented into multiple independent components: authentication data stored securely in the terminal, mutual authentication protocol between terminal and server, and session key establishment. This segmentation ensures that even if one component is compromised, the overall system remains secure through the chain of trust established by other components.
2Ease of manufacture
If the payment application logic is executed in the mobile terminal, then deployment and updating is facilitated, but vulnerability to modification of application logic by attackers increases
Solution Approach 1:
Security measures are implemented preliminarily through mutual authentication before any sensitive operations. The terminal and server authenticate each other in advance, establishing a trusted relationship that prevents later modification attacks. Session keys are established beforehand to protect subsequent communications.
Solution Approach 2:
The mutual authentication mechanism provides continuous feedback to verify the integrity of the application logic. The server verifies authentication data returned by the terminal, and the terminal verifies server responses, creating a feedback loop that detects any unauthorized modifications to the application logic.
3Reliability
If TLS protocol is used to protect communication between terminal and server, then confidentiality and integrity of data is improved, but vulnerability to man-in-the-middle attacks through stolen credentials increases
Solution Approach 1:
The invention introduces mutual authentication as an intermediary mechanism between the terminal and server. This intermediary layer verifies the identities of both parties before establishing the TLS connection, preventing man-in-the-middle attacks even if credentials are stolen. The authentication data acts as a mediator that validates the legitimacy of the communication partners.
Data Source
AI summary
The invention relates to a method for securing a contactless service transaction, said service (11) being stored in the mobile terminal (10), said transaction involving the mobile terminal, a contactless reader (12) and a remote server (13), said server storing at least one piece of data and/or sensitive function of the service, said terminal comprising a security module (14), said method being characterised in that the terminal also stores a contactless security application (15) and that it comprises: receiving (E41) a first value (α) for determining a session key; receiving (E49) a second value for determining a session key (β) and a first one-time password (OTPin); sending (E58) the second value for determining a session key and a message (MAC) for authenticating at least the first password, intended for being verified by the reader, said first and second determination values being used to calculate (E50, E61) a session key (Ksess) intended for being used to secure the exchanges.