Mobile Payment Authentication via Activation Code and PIN
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for mobile payment transactions, such as two-way authentication and two-way SSL authentication, are inefficient, cumbersome, and impractical for large user bases, requiring multiple passwords or complex certificate provisioning.
Innovation Solution
A method using a single password for both sync and payment authentication, where an activation code is sent to a server for verification, generating and encrypting a secret key, decrypting it with a PIN, and using tokens for user authentication and data syncing between a mobile device and server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two-way SSL authentication is used, then security is improved, but device complexity and ease of operation deteriorate due to requiring SSL certificate provisioning for each user
Solution Approach 1:
The patent extracts the authentication verification process from the client device and relocates it to the server. The server generates and manages authentication tokens, while the mobile device only needs to store a simple activation code and PIN. This eliminates the need for complex SSL certificate provisioning on millions of user devices while maintaining strong authentication security.
2Reliability
If two-way authentication is used, then mutual identity verification is improved, but ease of operation deteriorates due to requiring multiple authentication steps
Solution Approach 1:
The server performs preliminary authentication by verifying the activation code and generating authentication tokens before the actual payment transaction. The mobile device is pre-configured with the activation code during setup. This preliminary authentication establishes trust, allowing subsequent transactions to use simple token-based verification without requiring repeated complex authentication steps.
3Ease of operation
If a single password is used for both sync and payment operations, then ease of operation is improved, but security deteriorates due to reduced authentication factors
Solution Approach 1:
The patent segments the authentication system into two distinct components: a simple user-facing PIN for device operations and a server-generated secret key for security verification. The secret key is never exposed to the user but is used by the server to verify authentication tokens. This segmentation allows a simple single password experience while maintaining strong security through the hidden secret key mechanism.
Data Source
AI summary
A method for two factor authentication is described. The method comprises sending an activation code stored on a mobile device to a server for verification. An encrypted secret key generated by the server using the activation code is received. The secret key is decrypted using the activation code stored on the mobile device. The mobile device encrypts the secret key using a predetermined PIN. As a result of a user inputting the predetermined PIN, the secret key is decrypted, the mobile device generates a first token using the secret key and transmits the first token to the server to authenticate the user. After receiving authentication from the server, the information on the mobile device is synced with the server.