Dynamic Authentication Code Generation for Untrusted Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Untrusted terminals and networks pose risks for unauthorized access and fraudulent transactions in cashless transactions, as sensitive data like usernames and passwords can be intercepted and misused, requiring secure transformation and authentication methods that do not rely on cryptographic computations or key management.
Innovation Solution
The method involves sending a dynamic data element and transactional information to a consumer device, which creates an authentication code using a hash function, and then sending this code to an access device that forwards it to a service provider, allowing the service provider to recreate and verify the code, ensuring authentication without exposing sensitive data or requiring cryptographic keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic operations are used to protect sensitive data, then security against interception and misuse is improved, but computational resource requirements and system complexity increase
Solution Approach 1:
The patent extracts the password from the authentication transmission process. Instead of transmitting the password through potentially compromised channels, the system uses the password only locally on the consumer device to generate authentication codes. This removes the vulnerable element (password transmission) while maintaining security verification.
Solution Approach 2:
The system performs preliminary hashing of the password on the consumer device before transmission. The password is transformed into an authentication code through hashing operations conducted in advance on the client side, eliminating the need for later cryptographic verification of the password itself and reducing computational burden on servers.
2Ease of operation
If passwords are transmitted through untrusted networks, then authentication functionality is enabled, but vulnerability to interception and replay attacks increases
Solution Approach 1:
The patent changes the parameter being transmitted from static (password) to dynamic (authentication code). By transforming the authentication mechanism to use time-varying, transaction-specific codes generated through hashing, the system maintains authentication functionality while making intercepted data useless for future attacks.
Solution Approach 2:
Instead of transmitting the original password, the system transmits a copy in the form of an authentication code that can be verified without revealing the original secret. The authentication code serves as a functional copy that proves knowledge of the password without exposing the password itself.
3Reliability
If data is encrypted multiple times as it passes between systems, then security against unauthorized access is improved, but processing time and computational overhead increase
Solution Approach 1:
The patent extracts the password from the transmission chain entirely. By using password-based hashing to generate authentication codes that are verified through comparison rather than decryption, the system eliminates multiple encryption/decryption cycles and reduces processing time while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for securely authenticating a user of a consumer device at an access device comprising the following steps. First, a dynamic data element and a first set of transactional information is sent to the consumer device from the access device. Next, the consumer device creates an authentication code as a function of at least the dynamic data element, a subset of the first set of transactional information, and a password. The authentication code, along with other data, is then sent from the consumer device back to the access device. The access device then uses the authentication code to send an authentication request message to the service provider of the user. The service provider then attempts to authenticate the user by recreating the authentication code and comparing the recreated authentication code with the authentication code received from the access device.