Device-Level Authentication for Secure Electronic Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for a method to distribute data to computing devices for secure storage and use in electronic transactions without relying on user-provided data for continuous authentication, especially for devices without specialized storage like Secure Elements, while ensuring the data remains secure even if the device is compromised.
Innovation Solution
The method involves encrypting data with a first encryption that can only be decrypted by an external system, requiring device-level authentication through a key pair and attestation by a third-party processing server, ensuring the data is inaccessible if the device is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored locally in the device for convenient access, then ease of operation is improved, but security is worsened due to risk of compromise
Solution Approach 1:
The encryption key is segmented into two parts: a device-specific key stored in the device and a user-specific key stored on the server. Both parts are required to decrypt the data, so even if the device is compromised, the attacker cannot access the data without the user-specific key held by the user.
Solution Approach 2:
A trusted server acts as an intermediary between the user and the data. The server holds the user-specific decryption key and must authenticate the device before releasing decrypted data, providing an additional security layer without requiring continuous user input.
2Reliability
If specialized storage like Secure Elements is used, then security is improved, but device complexity and compatibility are worsened
Solution Approach 1:
The system uses standard cryptographic libraries and functions already present in modern operating systems to perform encryption and key management. This eliminates the need for specialized secure storage hardware while maintaining security through software-based cryptographic protection.
3Reliability
If user-provided data is required for continuous authentication, then security is improved, but ease of operation is worsened
Solution Approach 1:
User authentication is performed in advance during the data provisioning process. The user provides authentication data once to the server, which then stores the user-specific decryption key. Subsequent data access requires only device authentication, not repeated user input.
Solution Approach 2:
The system implements a feedback mechanism where the server verifies device authentication and automatically provides decrypted data to authenticated devices. This automated feedback loop eliminates the need for continuous manual user authentication while maintaining security through server-side verification.
Data Source
AI summary
A method for distributing data to a computing device using device level authentication includes: receiving a single use key from a payment institution, the single use key encrypted by the payment institution using a first encryption, a server public key, and device data; wrapping a device public key using the server public key; electronically transmitting at least the device data, the wrapped device public key, and the single use key to a server; receiving the single use key encrypted using a second encryption from the server, the second encryption using the device public key to encrypt the single use key; decrypting the single use key encrypted with the second encryption using a device private key; and electronically transmitting the decrypted single use key and payment credentials to a point of sale device.