Dynamic Symbol Validation for Fraud Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional user validation methods, such as PIN codes, are vulnerable to observation and memorization by fraudsters, leading to security breaches in various applications, including ATMs and point-of-sale transactions, as users often struggle to remember multiple codes and may record them insecurely.
Innovation Solution
A user validation system that uses images with multiple designatable areas containing symbols, where the distribution of symbols changes between presentations, requiring users to select a combination of symbols to match a predetermined code, thereby eliminating the need for numerical data entry and enhancing security by making it difficult for observers to determine the correct selection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a PIN code is used for user validation, then the validation process is simple and fast, but the system becomes vulnerable to observation and memorization by fraudsters
Solution Approach 1:
The validation code is segmented into multiple individual symbols (e.g., 4-6 distinct symbols) rather than a continuous numerical sequence. Each symbol is displayed in a separate designatable area, forcing the fraudster to observe and memorize multiple discrete elements rather than a simple continuous code, thereby increasing the cognitive load and difficulty of shoulder surfing attacks.
Solution Approach 2:
The system transitions from one-dimensional numerical input (sequential digits on a keypad) to two-dimensional spatial arrangement of symbols on a display screen. Symbols are distributed across multiple designatable areas in a grid or scattered layout, adding the spatial dimension to the validation process. This makes observation and memorization more difficult as the fraudster must track both the symbol identity and its position in a two-dimensional space.
2Reliability
If multiple PIN codes are required for different applications, then security coverage is improved, but users struggle to remember them and may record them insecurely
Solution Approach 1:
The system changes the parameter of code representation from numerical digits to visual symbols with distinct characteristics (colors, shapes, patterns). This transformation makes the codes more memorable and distinguishable for users, reducing the cognitive burden of remembering multiple validation codes across different applications. The visual nature of symbols enhances human memory capabilities compared to abstract numerical sequences.
3Ease of operation
If the same validation code is used across multiple applications, then ease of use is improved, but the potential risk is magnified
Solution Approach 1:
The system implements dynamic code generation where the validation code changes with each presentation. The distribution of symbols between designatable areas varies between subsequent presentations, and the same symbol may appear in different positions or be replaced by different symbols. This dynamic nature ensures that even if a fraudster observes one validation instance, the code will be different in subsequent validations, preventing replay attacks and reducing the impact of code compromise across multiple applications.
Data Source
AI summary
A method of validating a user, comprises the steps of:—storing for a user data representative of a validation code for the user comprising a combination of symbols selected from a set of symbols; presenting a displayed image including a plurality of designatable areas in which said set of symbols is distributed between said designatable areas such that each designatable area contains a plurality of said symbols; varying the image between subsequent presentations such that the distribution of said symbols between said designatable areas changes between subsequent presentations, validating a user in an validation routine by detecting designation by a user of a combination of said designatable areas in a presented image, and determining whether the combination of designated designatable areas contains the combination of symbols making up the validation code for said user.