Dual MAC Authentication for Payment Transaction Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic payment transactions are prone to corruption due to network faults, leading to authentication failures that cannot distinguish between network errors and fraudulent transactions, resulting in potential authorization of fraudulent transactions.
Innovation Solution
A system that generates and authenticates two Message Authentication Codes (MACs) using a symmetric cryptographic key, allowing for independent validation of payment data and application authentication, even in the presence of network errors, by comparing locally generated MACs with received ones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used, then the system is simple to implement, but network errors cause authentication failures that cannot distinguish between network errors and fraudulent transactions
Solution Approach 1:
The authentication mechanism is segmented into two independent MAC validations: authentication MAC for verifying payment application identity and integrity MAC for verifying data integrity. This segmentation allows the system to distinguish between authentication failures due to network errors versus fraudulent transactions, improving reliability without requiring a completely new authentication system.
Solution Approach 2:
The patent introduces Message Authentication Codes (MACs) as intermediary cryptographic elements that mediate between the payment application and authentication host. These MACs serve as trusted intermediaries that can detect both network errors and fraudulent transactions, enabling accurate differentiation without direct complex communication between all system components.
2Reliability
If authentication failures result in transaction declines, then fraudulent transactions are blocked, but legitimate transactions with low fraud risk are incorrectly rejected
Solution Approach 1:
The system applies different quality levels of authentication validation based on the specific failure mode. When authentication MAC fails, the system checks whether the integrity MAC might still be valid, and vice versa. This localized quality assessment allows the system to make informed decisions about transaction approval, blocking only truly fraudulent transactions while allowing legitimate ones with low fraud risk to proceed.
Solution Approach 2:
The authentication system provides feedback about the nature of authentication failures by validating both MACs independently. The feedback mechanism allows the authentication host to determine whether a failure is due to network errors (where one MAC might still be valid) or fraud (where both MACs fail), enabling more intelligent transaction decisions.
3Reliability
If the system validates both authentication MAC and integrity MAC, then authentication robustness improves, but validation time and processing resources increase
Solution Approach 1:
The payment application generates both authentication MAC and integrity MAC in advance as part of the normal transaction initiation process. This preliminary action ensures that both validation checks can be performed efficiently during the authentication phase without requiring additional time-consuming computations, as the cryptographic operations are already prepared and waiting to be validated.
Data Source
AI summary
An authentication system may receive an authentication MAC, an integrity MAC, and data transmitted from a payment application and a payment terminal. A local integrity MAC may be generated using the data as an input to a first cryptographic operation. The system may compare the local integrity MAC to the received integrity MAC to authenticate the received integrity MAC. A local authentication MAC may be generated using a second cryptographic operation and compare the local authentication MAC to the received authentication MAC. The system may authenticate the payment application in response to a successful authentication of at least one of the received authentication MAC or the received integrity MAC.