Transaction Authentication via Encrypted Payload and Unique Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, such as one-time passwords (OTPs), are vulnerable to man-in-the-middle attacks and do not adequately secure offline transactions, lacking robustness in ensuring the authenticity of transaction-related authentication.
Innovation Solution
A computer-implemented method and system that generates an encrypted payload with transaction details and a nonce, using unique encryption and decryption keys held by the authentication service provider and user mobile device, ensuring secure communication and authentication through a graphical code displayed to the user for decryption and validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional OTP algorithms (HMAC-OTP, TOPT) are used for authentication, then authentication security is improved compared to static passwords, but the system remains vulnerable to man-in-the-middle attacks and replay attacks
Solution Approach 1:
The patent introduces a certificate-based intermediary layer between the user and the authentication service. A digital certificate containing a public key is exchanged and stored in the mobile device, serving as a trusted mediator that enables secure keypair generation and authentication without direct trust between the user and service provider, thereby preventing man-in-the-middle attacks
Solution Approach 2:
The system performs preliminary actions by pre-generating and storing unique keypairs in the mobile device before authentication occurs. The public key is embedded in a certificate that is preliminarily exchanged and stored. This preliminary setup ensures that when authentication is needed, the unique keypairs are already in place to generate authentic tokens, preventing replay attacks
2Ease of operation
If offline OTP implementations using shared secrets are used, then authentication can be performed without continuous server connection, but security is compromised because the shared secret can be intercepted or stolen
Solution Approach 1:
The patent extracts the security-critical cryptographic operations from the server and places them in the mobile device. Each device has its own unique keypair stored locally, eliminating the need for a shared secret that could be intercepted. The mobile device independently generates authentication tokens using its private key, removing the vulnerability associated with server-held secrets
Solution Approach 2:
The mobile device performs self-service authentication by using its own unique keypair to generate authentication tokens. The device autonomously generates and signs tokens without requiring server intervention or sharing secrets with the server. This self-service approach ensures that even if the device is offline, authentication can proceed securely using locally stored cryptographic materials
3Reliability
If unique keypairs are generated and stored in the mobile device for each user, then authentication security against man-in-the-middle attacks is improved, but device complexity increases
Solution Approach 1:
The patent uses certificate-based copying where a digital certificate containing the public key is created and exchanged between parties. The certificate serves as a copy of the public key information that can be stored and verified without requiring complex key management infrastructure. This copying approach simplifies key distribution and storage while maintaining security
Data Source
Figure 1~5
Figure 2
Figure 3A
AI summary
A system and method for authenticating a transaction are provided. In a method at a server computer of an authentication service provider, an authentication request is received which requests authentication of a transaction and includes transaction details describing the transaction. An encryption key being unique to the authentication service provider and a user mobile device is obtained. An authentication prompt including at least some of the transaction details is generated. A payload including the authentication prompt is encrypted using the encryption key to output an encrypted payload. The encrypted payload is provided via a first communication channel to a user for acquisition and decryption by the user mobile device using a decryption key corresponding to the encryption key.