Electronic Ticket Authentication via Secure Element Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for dematerializing tickets, such as those using NFC for mobile terminals, require network access to authenticate electronic tickets, limiting their applicability to non-connected places, and involve complex infrastructure and memory constraints in secure elements like SIM cards.
Innovation Solution
A method and system that generates electronic tickets with embedded public keys, allowing autonomous authentication at access points without network access, using a secure element for signing challenges and storing tickets outside the secure element for flexibility and reduced complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If electronic tickets are stored in secure elements like SIM cards with network-based authentication, then security is improved, but the system cannot operate in locations not connected to a network
Solution Approach 1:
The authentication system is segmented into two independent parts: the electronic ticket stored in the secure element (containing public key and ticket data) and the authentication capability embedded in the access control device. This allows the mobile terminal to store authentication credentials locally without requiring continuous network access to a central authentication server, resolving the contradiction between security and offline operability.
Solution Approach 2:
The electronic ticket acts as an intermediary carrier that transports authentication credentials (public key, signature, service data) from the secure element to the access control device. This intermediary enables authentication in offline scenarios by bringing the necessary verification materials directly to the point of use, eliminating the need for real-time network connection to authentication servers.
2Reliability
If public key infrastructure is used for authentication, then security is improved, but the complexity of the system increases due to PKI server requirements
Solution Approach 1:
The complex PKI server infrastructure is extracted and replaced by embedding the essential authentication functionality directly in the secure element and access control device. Instead of relying on external PKI servers for certificate validation, the system uses locally stored public keys and digital signatures, simplifying the infrastructure while maintaining security through cryptographic verification.
Solution Approach 2:
The access control device performs self-service authentication by using the embedded public key to verify the digital signature on the electronic ticket locally, without requiring external PKI server intervention. This self-contained authentication mechanism reduces infrastructure complexity while maintaining security through cryptographic proof of authenticity.
3Reliability
If tickets are stored in secure elements, then security is improved, but memory constraints and infrastructure costs increase
Solution Approach 1:
The secure element stores only the essential authentication credentials (public key and ticket data) rather than complete authentication systems or large databases. This localized storage approach uses minimal memory capacity while maintaining security by keeping only the necessary cryptographic materials in the secure element, with the access control device handling the verification process.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Enables secure, flexible, and efficient access control to services by allowing authentication and ticket validation locally, reducing infrastructure costs and complexity, and preventing fraudulent use by ensuring the secure element's proximity to the access point.
Implementation Method 1
a step of short-range communication with a secure element of the mobile terminal, to ask this secure element to sign the random number with a private key of the mobile terminal stored in this secure element
Implementation Method 2
a step of authenticating the mobile terminal from the signed random number and the public key
Implementation Method 3
This validation occurs when they bring their mobile device close to an access control device capable of communicating with the mobile device, or more precisely, with a security element of the mobile device such as the SIM card, via NFC (Near Field Communication)
Data Source
Figure 1~5
Figure 6~8
AI summary
1. A system for providing a service to the user of a mobile terminal, said system comprising: - an entity (EGT) capable of generating an electronic ticket comprising identification data of said service (DIS) and a public key of the mobile terminal (PBKM) complementary to a private key (PVKM) of the mobile terminal stored in a secure element (SIM) of the mobile terminal; - a module for delivering the ticket to an application of the mobile terminal running outside the secure element (SIM); - a module (MCC) capable of receiving said electronic ticket (TIC) from the mobile terminal via short-distance communication means; and - a module (MAM) capable of authenticating said mobile terminal from the public key (PBKM) of the mobile terminal and a challenge implementing the private key (PVKM) of the mobile terminal.