Dynamic Passcode Encryption With DUKPT Key Derivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing point of sale (POS) and automated teller machine (ATM) systems rely on personal identification numbers (PINs) for security, but these are vulnerable to breaches due to the need for users to remember complex passwords and the lack of dynamic key management.
Innovation Solution
A system using Derived Unique Key Per Transaction (DUKPT) with a user device and server to generate a unique encryption key per transaction, utilizing user gestures, utterances, or biometrics to create a random passcode synchronized between devices, enhancing security without increasing user effort.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional PIN encryption is used, then users can easily remember their passwords, but security is vulnerable to breaches
Solution Approach 1:
The patent implements dynamic key derivation where encryption keys change per transaction using DUKPT (Derived Unique Key Per Transaction). Instead of static PIN encryption, the system generates unique session keys for each transaction, making the encryption dynamic and resistant to breaches while maintaining user-friendly input methods
Solution Approach 2:
The system changes the encryption parameter from static PIN-based encryption to dynamic key-based encryption. The key derivation process transforms a base key into multiple unique transaction keys, changing the cryptographic parameters to achieve higher security without increasing user burden
2Reliability
If unique encryption keys are generated per transaction, then security is enhanced, but device complexity increases
Solution Approach 1:
The system implements self-service key management where the device automatically derives unique transaction keys using the DUKPT algorithm. The key derivation process is automated and requires no manual intervention, with the device generating its own unique keys per transaction based on a base key and transaction counter
Solution Approach 2:
The base key is pre-configured in the device before transactions occur. This preliminary setup enables the device to autonomously generate unique transaction keys without requiring external key management infrastructure, simplifying the overall system architecture while maintaining high security
3Reliability
If multiple identifiers are required for security, then security is improved, but user effort increases
Solution Approach 1:
The patent implements a universal base key that serves multiple functions: it derives unique transaction keys, enables authentication, and supports various transaction types. This single base key replaces the need for multiple separate identifiers or passwords, achieving enhanced security without increasing user burden
Data Source
AI summary
Systems and methods may generally be used to authenticate user credentials. An example method may include using a personal identifier and a stored base derivation key to generate an initial key value, generating a current key value using an initial key value and a counter, determining a decryption key from the current key value and decrypting an encrypted secret value using the decryption key to identify a password. The method may include generating a password check value using the current key value and the device identifier, and determining whether to authenticate the user device based on whether the password check value indicates that the password is valid.