Mobile Secret Entry Using One-Time Key Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face risks of infection and security breaches when entering secrets into access devices, such as contactless devices, due to potential pathogen transmission and unauthorized access.
Innovation Solution
A method involving a user device encrypting a secret with a one-time use key and transmitting it to an access device, where it is verified using a public-private key system, ensuring secure and contactless communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user enters a secret into an access device, then the user can access the desired resource, but the user is exposed to the risk of pathogen transmission and security breaches
Solution Approach 1:
The patent extracts the secret entry function from the access device and relocates it to the user's mobile device. The user enters the secret into their own device rather than touching the access device, eliminating pathogen transmission risk while maintaining security through cryptographic verification of the secret on the user device before transmission to the access device
Solution Approach 2:
The mobile device acts as an intermediary between the user and the access device. It receives the secret from the user, encrypts it locally, and transmits only the encrypted form to the access device, which then verifies it without ever having access to the plaintext secret, thus preventing both pathogen transmission and security breaches
2Ease of operation
If a user enters a secret into an access device via keypad, then access is granted, but the heat from fingers can be detected by infrared devices to steal the secret
Solution Approach 1:
The patent replaces the mechanical keypad entry system with a digital secret entry system on the user's mobile device. Instead of pressing physical keys that generate heat detectable by infrared devices, the user enters the secret through a touchscreen or other non-contact interface on their own device, which then transmits the secret cryptographically to the access device, eliminating the infrared detection vulnerability
3Reliability
If the user device encrypts the secret locally and transmits it to the access device, then security is enhanced, but the device complexity increases
Solution Approach 1:
The user's mobile device performs self-service encryption using its existing secure environment and cryptographic capabilities. The device generates encryption keys, encrypts the secret locally, and manages the cryptographic operations autonomously without requiring additional external security hardware or complex centralized key management infrastructure, thus enhancing security while limiting the increase in overall system complexity
Data Source
AI summary
An access device is disclosed. The access device includes a non-transitory computer readable medium that includes code for performing a method that includes receiving, from a user device, a digital certificate and a seed, and then encrypting the seed, and a first access device key with a public key from the digital certificate to form encrypted data. The method also includes transmitting, to the user device, the encrypted data. The user device decrypts the encrypted data using a private key corresponding to the public key to obtain the seed, and the first access device key, verifies that the seed received from the access device matches the seed sent to the access device, and encrypts a secret or derivative thereof with the first access device key to form an encrypted secret or derivative thereof. The method also includes receiving the encrypted secret or derivative thereof.