Mobile Credential Segmentation for Secure Payment Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing payment schemes for mobile commerce transactions lack secure methods for transmitting payment credentials, as they are often sent in the clear, making them vulnerable to fraud, and existing cryptographic modules in mobile devices do not meet strict security standards for storing and processing payment information.
Innovation Solution
A system and method where a mobile device with a cryptographic module securely stores a mobile-based credential, which is transmitted to a remotely accessible server to combine with a server-based credential for obtaining payment credentials, ensuring secure transaction processing by using encrypted credentials and decryption keys, and never storing the mobile-based credential longer than necessary, thus minimizing risk in case of compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If payment credentials are transmitted in the clear for simplicity and speed, then transaction processing is faster and easier, but security is compromised and fraud vulnerability increases
Solution Approach 1:
The payment credential system is segmented into multiple components: a credential identifier stored in the mobile device, and the actual payment credentials stored securely on the server. This segmentation allows the mobile device to quickly initiate transactions using only the identifier, while the actual credentials remain protected, thus maintaining both speed and security.
Solution Approach 2:
A credential verification service acts as an intermediary between the mobile device and the payment processing network. This intermediary receives the credential identifier from the mobile device, retrieves the actual credentials from the server, verifies them, and then processes the transaction. This eliminates the need for the mobile device to store or transmit sensitive credentials directly, maintaining security while enabling fast transactions.
2Ease of operation
If payment credentials are stored on physical cards or sent via SMS for ease of use, then accessibility and convenience are improved, but security is weakened as credentials can be easily read or intercepted
Solution Approach 1:
The sensitive payment credentials are extracted from the mobile device and stored securely on the server. The mobile device retains only a non-sensitive credential identifier that can be easily stored and transmitted. This extraction eliminates the security risks associated with storing credentials on physical cards or transmitting them via SMS, while maintaining ease of use through the simplified identifier.
Solution Approach 2:
The system uses single-use or time-limited credential tokens that are generated for each transaction or session. These temporary credentials are discarded after use, preventing replay attacks and reducing the window of opportunity for fraud. This approach maintains convenience while significantly reducing fraud vulnerability compared to static credentials on physical cards.
3Reliability
If cryptographic modules in mobile devices are used for credential storage, then security is improved, but existing modules do not meet strict security standards
Solution Approach 1:
The server acts as an intermediary secure storage facility that meets strict security standards. Instead of relying on the cryptographic modules in mobile devices (which may not meet all standards), the system uses the server's secure infrastructure to store the actual credentials. The mobile device's cryptographic module is used only for protecting the credential identifier, which is insufficient on its own but adequate for the limited purpose of initiating transactions.
Solution Approach 2:
The security responsibilities are segmented between the mobile device and the server. The mobile device's cryptographic module handles only the credential identifier with lower security requirements, while the server's cryptographic infrastructure handles the actual payment credentials with full compliance to strict security standards. This segmentation allows the system to meet high security standards without requiring the mobile device's hardware to be perfectly secure.
Data Source
AI summary
A mobile device of a consumer can have a mobile-based credential stored in a secure memory thereof and an associated alias. Techniques for conducting a transaction with the mobile device may involve receiving a request for the mobile-based credential from a remotely accessible server in response to a requestor device receiving the alias from the consumer. The mobile-based credential can be accessed from the secure memory and transmitted to the remotely accessible server. The mobile-based credential is then usable at the remotely accessible server in combination with a server-based credential stored thereat for obtaining payment credentials to complete the transaction.