Mobile Transaction Authentication Using Biometric Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile device transactions are insecure and inefficient due to reliance on single-factor authentication, accidental transaction risks, and vulnerabilities in client and server systems, leading to potential financial and reputational losses.
Innovation Solution
A method for authenticating transactions on mobile devices using a supplemental ID, such as biometric data, which is verified along with a mobile device ID, eliminating the need to store sensitive information on the device and enhancing security through two-credential authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If single-factor authentication (username/password) is used for mobile device transactions, then ease of operation is improved, but security is worsened
Solution Approach 1:
The authentication process is segmented into two distinct phases: enrollment (where biometric data is captured and stored on the server) and verification (where biometric data is used for authentication). This segmentation allows the system to maintain security while improving ease of operation, as users only need to provide biometric data during verification without manually entering passwords.
Solution Approach 2:
Biometric data serves as an intermediary authentication mechanism between the user and the transaction system. Instead of directly using passwords or PINs, the system uses biometric characteristics (fingerprint, voice, facial recognition) as a mediator that automatically verifies user identity, thereby enhancing security while maintaining ease of operation.
2Productivity
If sensitive information is stored on the mobile device for quick access, then productivity is improved, but security is worsened due to device loss or theft
Solution Approach 1:
The patent extracts sensitive information (biometric data and personal information) from the mobile device and stores it exclusively on the server system. The mobile device only contains application code and temporary transaction data, not the actual sensitive information. This extraction ensures that even if the device is lost or stolen, the sensitive information remains secure on the server, while productivity is maintained through quick server-based verification.
3Reliability
If comprehensive authentication data is transmitted with each transaction, then security is improved, but data transmission efficiency is worsened
Solution Approach 1:
The system performs preliminary authentication during the enrollment phase, where biometric data is captured, processed, and stored on the server before any transactions occur. During actual transactions, only a verification request containing minimal data (transaction ID and biometric template reference) needs to be transmitted, rather than sending complete authentication datasets. This preliminary action reduces data transmission requirements while maintaining security.
Data Source
AI summary
The present systems and methods provide for secured communication between a mobile device and a server/gateway. The systems and methods can be used, for example, as a way to confirm whether or not a transaction was actually authorized by the user, thereby settling a chargeback dispute for a previously executed transaction. The method comprises receiving the dispute regarding the transaction including associated transaction data, and retrieving a digital signature associated with the transaction data, the digital signature computed by signing the transaction data. The digital signature is then verified using a public key, wherein the public key corresponds to a private key stored on a mobile device. It is then determined whether or not the transaction is fraudulent based on a verification result of the digital signature.