Mobile Verification Tokens with Dynamic dCVV2 for Skimming Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The prevalence of skimming fraud in contactless and wireless transactions, where magnetic stripe data can be easily intercepted and copied without physical possession of the card, poses a significant challenge, especially in online purchases where traditional security measures like CVV are not applicable.
Innovation Solution
A verification token integrated into mobile communication devices that securely reads and transmits identification information from consumer devices to a validation entity, using encryption and authentication processes to obtain a dynamic card verification value (dCVV2) for transaction authorization, thereby enhancing security and reducing fraud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional CVV verification is used for contactless transactions, then transaction speed is maintained, but security is compromised due to ease of data interception
Solution Approach 1:
The patent implements dynamic verification values (dCVV2) that change with each transaction instead of static CVV codes. The verification value is generated dynamically by the mobile device using cryptographic operations with unique identifiers and timestamps, making each verification value unique and preventing replay attacks. This dynamic approach resolves the contradiction by maintaining fast contactless transaction processing while significantly improving security against skimming fraud.
Solution Approach 2:
The patent changes the verification parameter from a static CVV code to a dynamic verification value that incorporates multiple changing parameters including timestamps, random numbers, and device identifiers. The verification value is generated through cryptographic hashing with these changing parameters, ensuring that even if intercepted, the value cannot be reused for fraudulent transactions. This parameter transformation resolves the security-speed contradiction in contactless transactions.
2Reliability
If dynamic verification values are generated and verified, then fraud prevention is improved, but transaction time is increased
Solution Approach 1:
The mobile device performs preliminary cryptographic setup and stores verification algorithms locally before transactions occur. The device pre-configures cryptographic keys and verification logic, so when a transaction occurs, it only needs to execute the pre-prepared verification algorithm rather than performing complex cryptographic operations from scratch. This preliminary preparation significantly reduces transaction processing time while maintaining strong fraud prevention capabilities.
Solution Approach 2:
The patent replaces complex mechanical verification processes with optimized cryptographic algorithms that run efficiently on mobile processors. Instead of using slow traditional verification methods, the system employs hardware-accelerated cryptographic operations (such as SHA-256 hashing and elliptic curve operations) that are natively supported by modern mobile devices, reducing verification time while enhancing security.
3Reliability
If verification token is integrated into mobile device, then transaction authorization confidence is improved, but device complexity increases
Solution Approach 1:
The patent merges the verification token functionality directly into the mobile device's existing operating system and payment application stack. The verification token is implemented as a software module that integrates with the device's secure element, cryptographic libraries, and payment processing frameworks. This merging approach consolidates multiple verification components into a unified system, reducing overall complexity while maintaining high authorization confidence.
Solution Approach 2:
The mobile device performs self-verification using its own built-in cryptographic capabilities and stored verification tokens. The device generates and verifies its own verification values autonomously without requiring external verification hardware or complex intermediary systems. This self-service approach leverages the device's existing processing power and security features, avoiding the need for additional complex verification infrastructure while enhancing authorization reliability.
Data Source
AI summary
A method is disclosed. The method includes receiving, by a computer from a portable device via near field communications, a primary account number. The method includes transmitting, by the computer, to a validation entity computer over a communications network comprising the Internet or a cellular phone network, a request for dynamic account information associated with the primary account number. The validation entity computer obtains and sends the dynamic account information to the computer. The method also includes receiving, by the computer from the validation entity computer over the communications network comprising the Internet or the cellular phone network, the dynamic account information and populating a form on the computer with the dynamic account information.