Debit Transaction Authorization via Pre-Validated Cryptograms

Solution Overview

Problem

Conventional debit transaction systems require lengthy authentication processes, especially when customers incorrectly input personal identification numbers or exceed daily/weekly withdrawal limits, leading to inefficiencies in fund withdrawals.

Innovation Solution

A system and method where a debit terminal transmits an authorization request message to a computer server for a debit transaction without authenticating the operator, using a payment token to generate and verify cryptograms, allowing the server to authorize and debit a financial account based on stored default payment amounts without operator confirmation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional two-factor authentication methodology is used for debit transactions, then security and reliability are improved, but transaction time and operational complexity increase

Engineering Contradiction:

Improvetransaction securityVSAvoidtransaction time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary authentication by verifying the payment token and generating authorization codes before the actual transaction occurs. The authorization code is validated in advance, so that during the transaction itself, only a simple code verification is needed rather than full authentication, thus reducing transaction time while maintaining security

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The authentication process is extracted and separated from the transaction process. The system extracts the authentication step into a preliminary phase where the payment token is verified and authorization code is generated, allowing the main transaction to proceed independently with already-validated credentials

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If conventional two-factor authentication methodology is used for debit transactions, then security is improved, but ease of operation deteriorates

Engineering Contradiction:

Improvetransaction securityVSAvoidoperational simplicity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system performs preliminary authentication by verifying the payment token and generating authorization codes before the actual transaction occurs. The authorization code is validated in advance, so that during the transaction itself, only a simple code verification is needed rather than full authentication, thus reducing transaction time while maintaining security

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The authentication process is extracted and separated from the transaction process. The system extracts the authentication step into a preliminary phase where the payment token is verified and authorization code is generated, allowing the main transaction to proceed independently with already-validated credentials

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If authentication processes handle incorrect PIN or exceeded withdrawal limits, then reliability is improved, but transaction time and complexity increase

Engineering Contradiction:

Improvetransaction validationVSAvoidauthentication process complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system introduces an intermediary authorization code that mediates between the authentication system and the transaction system. This code serves as a pre-validated credential that simplifies the interaction between different system components, reducing the complexity of handling authentication failures and validation logic across multiple systems

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11481779B2System and method for authorizing a debit transaction without user authentication

Publication Date: 2022.10.25 THE TORONTO DOMINION BANK

AI summary

A method of authorizing a debit transaction involves a server receiving from a debit terminal an authorization request message requesting authorization for a debit transaction initiated from the debit terminal. The authorization request message includes a payment credential, a cryptogram and authorization data. The server authorizes the debit transaction without receiving confirmation of authenticity of an identity of an operator of the debit terminal. The server authorizes the debit transaction by confirming that the cryptogram was generated from the payment credential and the authorization data; determining from a database an account number and a default payment amount that is associated with the payment credential in the database, and debiting a financial account associated with the account number by a debit amount equal to the default payment amount. The server transmits to the terminal an authorization response message that authorizes the terminal to release funds in the debit amount.