IC Chip Authentication for Secure Mobile Service Login
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for online services, designed for use on PCs, become inconvenient and insecure when applied to portable devices like smartphones, leading to increased risks of token loss and password interception.
Innovation Solution
A system utilizing an IC card, referred to as a sub-SIM, integrated with a user's device, stores a private key and provides secure authentication through public key encryption, enabling automatic login and secure data communication without the need for additional tokens or devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a token is used for authentication, then security is improved, but portability and convenience deteriorate because users must carry additional devices
Solution Approach 1:
The patent combines the authentication function with the mobile device itself by storing the private key in the device's built-in secure element (SE), eliminating the need for separate token devices. The SE integrates cryptographic functions directly into the mobile terminal, allowing users to authenticate online services without carrying additional hardware tokens.
Solution Approach 2:
The secure element in the mobile device serves multiple functions including authentication, key storage, and secure data processing. This universal security module replaces multiple service-specific tokens with a single multi-functional security infrastructure that works across different online services.
2Ease of operation
If one-time password via mail is used, then convenience is improved, but security deteriorates because passwords can be intercepted or accessed by unauthorized persons
Solution Approach 1:
The patent extracts the private key from vulnerable communication channels (mail, SMS) and stores it securely in the device's built-in secure element. This removes the password transmission step entirely, replacing it with cryptographic authentication based on the stored private key, thereby eliminating interception risks while maintaining convenience.
Solution Approach 2:
The patent replaces the mechanical/password-based authentication system (relying on mail/SMS delivery) with a cryptographic system based on public key infrastructure. The secure element performs cryptographic operations to authenticate users without transmitting passwords, substituting the vulnerable mail-based mechanism with secure cryptographic verification.
3Reliability
If service-specific tokens are used for each online service, then security is improved, but device complexity and administrative burden increase
Solution Approach 1:
The patent implements a universal secure element that can authenticate multiple online services with a single device. The secure element stores private keys and performs cryptographic operations for different services, eliminating the need for multiple service-specific tokens and reducing both device complexity and administrative management burden.
Solution Approach 2:
The patent segments the security function into a dedicated secure element within the mobile device, separating cryptographic operations from the main processor. This modular security architecture allows the secure element to independently handle authentication for multiple services, reducing overall system complexity while maintaining high security standards.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
When a user starts an application, user authentication using a PIN code or the like is first performed. If the user authentication succeeds (in other words, if a person operating the application is confirmed to be the user himself or herself), a function restriction on an IC chip is removed, and a mode in which a function provided by the IC chip is available is established. The application utilizes the function of the IC chip to generate an electronic signature using a private key. When the electronic signature and a user ID are transmitted to a server of an online service, the server verifies the electronic signature using a corresponding electronic certificate, and when the user ID is confirmed to be a user ID transmitted from a legitimate user, the user is permitted to utilize the online service.