Contactless Card MAC Authentication for Merchant Limit Override
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for bypassing transaction limits on contactless payment instruments require customers to contact their bank and undergo cumbersome security verification, leading to a diminished customer experience and reduced transaction completion rates.
Innovation Solution
A cryptographic authentication system using a contactless card and mobile device for efficient transaction limit bypass, where the mobile device communicates with the card to generate and verify a message authentication code (MAC) cryptogram, allowing the server to authorize transactions based on GPS coordinates and merchant geofences, enabling users to exceed transaction limits with minimal interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security protocols are used to prevent card theft and compromise, then security is improved, but customer experience deteriorates due to cumbersome verification processes
Solution Approach 1:
The authentication process is segmented into two parts: a cryptographic component (MAC generation and verification) that ensures security, and a user interaction component (mobile device confirmation) that ensures ease of operation. This segmentation allows each component to be optimized independently for its specific function.
Solution Approach 2:
The mobile device acts as an intermediary between the contactless card and the server. It receives the MAC cryptogram from the card, displays it for user confirmation, and transmits the confirmed authentication to the server. This intermediary role streamlines the authentication process while maintaining security.
2Reliability
If transaction limits are imposed to reduce risk, then security is improved, but transaction completion rate deteriorates when customers need to contact the bank
Solution Approach 1:
The system performs preliminary cryptographic authentication between the mobile device and the contactless card before the transaction is submitted to the server. This preliminary action validates the transaction intent locally, allowing the server to process the transaction without requiring additional customer contact or verification steps.
Solution Approach 2:
The mobile device and contactless card perform self-authentication through cryptographic verification of the MAC cryptogram. This self-service authentication eliminates the need for customers to contact the bank for verification, thereby maintaining transaction completion rates while still enforcing transaction limits.
3Reliability
If detailed security verification is required to lift transaction limits, then security is improved, but time consumption increases
Solution Approach 1:
The patent replaces the mechanical system of phone-based security verification with a cryptographic system. Instead of requiring customers to answer security questions over the phone, the system uses mathematical verification of the MAC cryptogram generated by the contactless card and validated by the mobile device. This substitution dramatically reduces time consumption while maintaining or improving security.
Data Source
AI summary
Example embodiments of systems and methods for a cryptographic bypass system, comprising: a contactless card; and a server, wherein the server is configured to: receive a cryptogram and location data after a tap of the contactless card to a client device, identify a first merchant based on the location data, set a flag associated with the first merchant and the contactless card, receive a transaction request from a merchant payment system of the first merchant associated with the contactless card, wherein the transaction request indicates a transaction amount, and approve the transaction request when the transaction amount exceeds a first transaction limit when the flag is set.