Network Authentication Using Encrypted Private Key and PIN
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network authentication methods for secure electronic transactions are inadequate due to vulnerabilities in customer computer environments to malicious software and malware, and the inconvenience of requiring multiple identity verification devices for different institutions.
Innovation Solution
A network authentication method using a client device and a verification server, where the client device stores a certificate reference and a reference private key encrypted with a PIN, generating a digital signature for transaction data, and the verification server verifies the signature using the public key, ensuring secure transactions without additional identity verification devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional one-factor authentication (user-id and password) is used, then the authentication process is simple, but it is not secure enough against malicious software and malware attacks
Solution Approach 1:
The patent combines multiple authentication factors (something you know - PIN code, something you have - encrypted private key in secure storage, and device-specific hardware characteristics) into a unified authentication mechanism. The authentication application integrates these elements to generate digital signatures that provide strong security without requiring separate physical devices for each institution.
Solution Approach 2:
The authentication system is designed to be universal across different institutions and platforms. The same authentication application and encrypted private key mechanism can be used with multiple different service providers, eliminating the need for institution-specific identity verification devices while maintaining high security standards.
2Reliability
If identity verification devices (USB device with PKI certificate, IC electronic card, or dynamic token) are used to verify customer identity, then authentication security is improved, but the cost of customer service for personalization, distribution and troubleshooting becomes considerable
Solution Approach 1:
Instead of distributing physical identity verification devices, the patent uses digital copies of the private key that are encrypted and stored securely in the customer's own device. The authentication application creates and manages these digital credentials, eliminating the need for physical device manufacturing, distribution, and troubleshooting infrastructure.
Solution Approach 2:
The authentication system enables customers to manage their own credentials through the authentication application. The private key is generated and encrypted with the customer's PIN code, which only they can access. This self-managed approach eliminates the need for customer service personnel to assist with device personalization, distribution, and troubleshooting.
3Reliability
If different identity verification devices are required for different institutions, then each institution can maintain its own security standards, but it proves to be quite inconvenient for customers
Solution Approach 1:
The authentication system is designed to work universally across multiple institutions using the same encrypted private key mechanism. The digital signature generated by the authentication application can be verified by any institution that trusts the certificate authority, allowing customers to use a single authentication method with multiple service providers.
Solution Approach 2:
The patent introduces a certificate authority as an intermediary that issues digital certificates verifying the binding between the encrypted private key and the customer's identity. This intermediary enables different institutions to trust the same authentication mechanism without requiring institution-specific devices, as the certificate authority acts as a trusted mediator that all parties can recognize.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A client device (2) stores a certificate reference mapped uniquely to a certificate (31), which is assigned to an end user (5), and a reference private key (23) obtained by encrypting a private key (313) with a PIN code determined by the end user (5). The client device (2) generates a digital signature for transaction data associated with the certification reference (32) using a current key that is obtained by decrypting the reference private key (23) with a user input code obtained through an input operation. If the input code is the same as the PIN code, the current key is the private key. A verification server (3) verifies, based on a public key (312) of a stored certificate (31), whether a received digital signature is signed with the private key (313), and obtains from the digital signature the transaction data when verification result is affirmative.