Secure Credential Provisioning via One-Time Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely protecting credential data during transmission and storage, as attackers can intercept and breach sensitive information, compromising transaction security.
Innovation Solution
A method involving a user device generating a one-time public key to send a provisioning request to a server, receiving an encrypted response with a storage protection key, and decrypting credential data only at transaction time, ensuring end-to-end protection by storing the encrypted data and key separately.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credential data is transmitted and stored in plaintext for easy access, then operational convenience is improved, but security is worsened as attackers can intercept and breach sensitive information
Solution Approach 1:
The credential data is encrypted before transmission and storage using a storage protection key. This preliminary encryption action ensures that even if the encrypted credential data is intercepted or accessed during transmission or storage, it remains protected and cannot be used by attackers without the decryption key.
Solution Approach 2:
The system separates the encrypted credential data from the storage protection key, storing them in different locations. The encrypted credential data can be stored remotely while the storage protection key is stored locally in the user device. This segmentation ensures that an attacker would need to compromise both components to access the credential data.
2Object-affected harmful factors
If credential data is encrypted during transmission and storage, then security is improved, but access complexity increases as decryption requires multiple components
Solution Approach 1:
The system combines the encrypted credential data with the storage protection key in a unified decryption process. When credential data needs to be accessed, both the encrypted credential data and the storage protection key are retrieved and used together to decrypt the credential data, simplifying the access workflow while maintaining security.
3Object-affected harmful factors
If the storage protection key is stored separately from encrypted credential data, then security is improved through segmentation, but retrieval time increases due to needing to access both components
Solution Approach 1:
The storage protection key is pre-stored in the user device in an encrypted form using a key encryption key. This preliminary preparation ensures that when credential data needs to be accessed, the decryption process can proceed efficiently without requiring additional key retrieval steps, thus minimizing retrieval time while maintaining security.
Data Source
AI summary
Embodiments can provide methods for securely provisioning sensitive credential data, such as a limited use key (LUK) onto a user device. In some embodiments, the credential data can be encrypted using a separate storage protection key and decrypted only at the time of a transaction to generate a cryptogram for the transaction. Thus, end-to-end protection can be provided during the transit and storage of the credential data, limiting the exposure of the credential data only when the credential data is required, thereby reducing the risk of compromise of the credential data.