Mobile Device Secure Registration via Asymmetric Cryptography
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing risk of online and identity fraud, particularly in online banking and e-commerce, necessitates a secure method to verify that transactions are performed by the actual user rather than an imposter, as traditional web session interfaces are no longer trusted due to the prevalence of viruses and malware.
Innovation Solution
A computer-readable medium embodying a computer program that registers a mobile device for use in a session by generating and sending a message with a code, encrypting it with the device's private key, and confirming transactions through the mobile device, which can display requests for approval and receive biometric inputs to verify user authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional web session interfaces are used for user authentication, then ease of operation is improved, but security deteriorates due to the prevalence of viruses and malware
Solution Approach 1:
The patent introduces a mobile device as an intermediary authentication mechanism between the user and the online system. Instead of relying solely on the potentially compromised web session interface, the system uses the mobile device to generate and verify cryptographic signatures, acting as a trusted mediator that enhances security while maintaining ease of operation through automated authentication.
2Reliability
If asymmetric cryptography with private key encryption is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-configuring the mobile device with cryptographic key pairs during device initialization or first-use setup. The private key is securely stored in the device's secure element, and the corresponding public key is registered with the online system in advance. This preliminary configuration eliminates the need for complex real-time key management during authentication operations.
3Reliability
If biometric verification is added to the authentication process, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The patent implements self-service by utilizing the mobile device's existing biometric authentication capabilities (fingerprint sensor, facial recognition, or iris scanner) that are already integrated into the device's operating system. The biometric verification is performed automatically by the device's native authentication framework, requiring minimal user intervention while maintaining high security standards.
Data Source
AI summary
A computer-readable medium embodies a computer program for registering a mobile device. The computer program comprises computer-readable program code for: generating a first message including a first code in response to receiving a request to register the mobile device for use with a future session with an entity, sending the first message including the first code, receiving a second message including the first code and at least a portion encrypted using a private key associated with the mobile device, and registering the mobile device for use with the future session based on at least the portion of the second message being encrypted using the private key associated with the mobile device.