Fingerprint Card Authentication Without PIN Entry at Payment Terminals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IC card transaction systems face security risks due to PIN code leakage and the inability to function when the user forgets the PIN code, with authentication information being directly received and verified by terminal devices, making them vulnerable to network attacks and hijacking.
Innovation Solution
A fingerprint verification method is integrated into the IC card, allowing the card to verify the user's fingerprint before proceeding with transactions, eliminating the need for a PIN code input, and ensuring secure authentication by controlling transaction approval based on fingerprint verification results and terminal compatibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If PIN code verification is used for IC card authentication, then the authentication process is simple and familiar to users, but security risks arise due to PIN code leakage through peeping or interception
Solution Approach 1:
The patent replaces the mechanical/PIN-based authentication system with a biometric fingerprint verification system. The fingerprint card includes a fingerprint acquisition unit that captures fingerprint images, and a verification unit that compares stored fingerprint templates with captured images, eliminating the need for users to input PIN codes and thereby preventing PIN leakage through peeping or interception.
Solution Approach 2:
The patent introduces a fingerprint template as an intermediary between the user and the authentication system. Instead of directly verifying PIN codes, the system verifies fingerprint images against stored templates, adding a layer of security that prevents direct exposure of sensitive authentication information.
2Reliability
If PIN code verification is required for IC card transactions, then security control is maintained, but the card becomes unusable when users forget or mistype their PIN codes
Solution Approach 1:
The patent replaces the PIN code input mechanism with a fingerprint capture and verification mechanism. Users place their finger on the fingerprint sensor instead of typing PIN codes, eliminating forgetting or mistyping issues while maintaining security through biometric verification.
Solution Approach 2:
The fingerprint verification system is self-service in nature, automatically capturing and verifying fingerprint images without requiring user knowledge or input of authentication codes. The system handles the entire verification process autonomously once the user places their finger on the sensor.
3Extent of automation
If authentication information is received and verified by the terminal device, then the terminal has full control over authentication, but vulnerability to network attacks and terminal hijacking increases
Solution Approach 1:
The patent segments the authentication process into two independent parts: fingerprint verification performed by the fingerprint card itself, and transaction processing performed by the terminal. The fingerprint card contains its own verification unit that independently verifies fingerprints without requiring the terminal to handle or process authentication information, reducing the terminal's attack surface.
Solution Approach 2:
The patent introduces the fingerprint card's internal verification unit as an intermediary that handles authentication independently. The terminal only receives verification results rather than authentication data, creating a security architecture where sensitive information never leaves the fingerprint card.
Data Source
AI summary
A method for communicating with a fingerprint card to perform transaction, comprising the following steps: receiving a Processing Options Data Object List (PDOL) request from a terminal, sending a waiting time extending instruction at a preset interval, obtaining and verifying a user's fingerprint, determining a specific transaction type from the PDOL request, matching the terminal type, ensuring the transaction is not refused by an application controller, and returning a response with an Application Interchange Profile (AIP) and Application File Locator (AFL) to the terminal. It also involves returning a read record based on the AFL. According to the present invention, a process of using the fingerprint card includes an additional step of verifying the fingerprint. Once the fingerprint verification is successful, there is no need to enter a password or sign anymore. This solves the problem of being unable to use any smart card due to forgetting its password.