Financial Account Encryption via Card Verification Number
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current payment systems face high costs due to PCI compliance requirements when storing and retrieving financial account numbers, and existing solutions that store numbers as encrypted BLOBs without keys fall outside compliance, necessitating a method to securely encrypt and decrypt account information while maintaining compliance.
Innovation Solution
A method that enables encryption and decryption of financial account numbers using a card verification number on authorized user devices, where the encrypted information is replicated across devices, and the decryption module prompts users for the verification number to produce valid-looking credit or debit card numbers for transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a third party stores financial account numbers traditionally, then the system can retrieve and process transactions, but the system incurs high PCI compliance costs and complexity
Solution Approach 1:
The patent extracts the sensitive financial account number from the third-party system entirely. Instead of storing the actual account number, the system stores only an encrypted version that cannot be decrypted by the third party. This removes the compliance burden from the third party while maintaining transaction functionality.
Solution Approach 2:
The system segments the encryption key management between the user's device and the third-party system. The user's device holds the encryption key and performs decryption locally, while the third-party system only stores encrypted data. This segmentation allows the third party to operate without PCI compliance while maintaining security.
2Ease of manufacture
If a third party stores encrypted BLOBs without keys, then PCI compliance costs are reduced, but the system cannot retrieve valid account numbers for transactions
Solution Approach 1:
The system performs preliminary encryption of the financial account number on the user's device before transmission to the third party. The encrypted version is stored in advance, and when needed, the user's device can decrypt it locally using the stored key, enabling transaction processing without third-party access to the actual number.
Solution Approach 2:
The user's device acts as an intermediary that holds the encryption key and performs decryption locally. This intermediary role allows the third-party system to store encrypted data without being able to decrypt it, while still enabling valid account number retrieval when the user initiates a transaction.
3Ease of manufacture
If the system implements client-side decryption, then PCI compliance requirements are avoided, but security risks increase if the decryption key is compromised
Solution Approach 1:
The encryption key is stored locally on the user's device rather than on the third-party server. This local storage ensures that even if the third-party system is compromised, the encryption key remains secure on the user's device. The key is never transmitted to or stored on the third-party system, maintaining security while enabling compliance-free operation.
Data Source
AI summary
A decryption module is enabled on one or more authorized devices. A user's financial account information is encrypted using a card verification number, or some secret known to the user and replicated onto the authorized devices. The user requests processing of a financial transaction using the previously-encrypted financial account information. The authorized device retrieves the encrypted financial account information and prompts the user to enter the card verification number (or other secret known to the user that was used to encrypt the financial account information). The decryption module decrypts the financial account information using the card verification number entered by the user, and the decrypted financial account information resembles a valid credit card or debit card number and will pass a Luhn test. The decrypted financial account information is transmitted to process the financial transaction initiated by the user.