Mobile Wallet Secure Payments Using Cryptographic Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing payment systems are fragmented, insecure, and vulnerable to fraud, making it difficult for consumers to securely make transactions across different platforms and for merchants to prevent fraudulent activities.
Innovation Solution
A mobile-based payment system that securely stores payment information on the user's device, using cryptographically signed messages and public key certificates to authenticate transactions, ensuring that sensitive data is not exposed to merchants or cloud storage, and allowing for remote, recurring, and multi-party-approved transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If payment information is stored on cloud servers or with merchants, then transaction convenience is improved, but security and risk of data exposure deteriorate
Solution Approach 1:
The payment system is segmented into multiple independent components: the mobile device stores encrypted payment information locally, the payment server stores only encrypted data without decryption keys, and the POS terminal only processes transactions. This segmentation ensures that no single point holds both data and decryption capability, preventing unauthorized access even if one component is compromised.
Solution Approach 2:
The patent introduces cryptographic intermediaries (encryption keys, digital signatures, and certificates) that mediate between the payment information and the systems accessing it. The mobile device generates key pairs, encrypts payment data with public keys, and signs transactions with private keys. This intermediary cryptographic layer ensures that even if data is intercepted, it cannot be decrypted or forged without the corresponding private keys.
2Adaptability or versatility
If multiple payment systems are supported across different platforms, then versatility is improved, but system complexity and integration difficulty worsen
Solution Approach 1:
The patent implements a universal payment protocol that works across multiple platforms (mobile devices, online systems, brick-and-mortar POS terminals). The standardized cryptographic authentication mechanism and token-based transaction approach allow the same system to serve online merchants, offline retailers, and mobile commerce without requiring platform-specific implementations, thus achieving multi-functionality.
3Reliability
If cryptographic authentication is implemented for all transactions, then fraud prevention is improved, but transaction processing time and complexity worsen
Solution Approach 1:
The system performs preliminary cryptographic actions during setup: the mobile device generates key pairs and stores them securely, the payment server stores encrypted payment information with public keys, and the authentication credentials are pre-configured. During actual transactions, these pre-established cryptographic elements enable rapid verification without time-consuming key generation or complex multi-step authentication, thus reducing processing time while maintaining strong fraud prevention.
Data Source
AI summary
A payment system implemented on a mobile device authenticates transactions made via the mobile device. The mobile device generates a public-private key pair and receives an authenticating input from a user of the device. The public key is sent to a secure payment system, and the authenticating input is used to generate a symmetric key that encrypts the private key. After a transaction is initiated, the mobile device receives an authenticating input from the user. The symmetric key is generated from the authenticating input and the mobile device attempts to decrypt the private key from the encrypted private key using the symmetric key generated by the user's input. The decrypted key is used to sign a transaction authorization message which is sent to the secure payment system, along with payment information, which can verify the signed message via the public key. Additional techniques related to secure payments are also disclosed.