NFC Payment Credential Provisioning With Device-Bound Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing NFC-enabled devices face security vulnerabilities and inefficiencies in securely provisioning and processing transaction accounts, leading to potential data compromise and reduced transaction speed.
Innovation Solution
A system that encrypts and secures transaction account data using White Box Cryptography, generating and managing encryption keys at the native development key level, and employs an attestation service to verify device integrity, ensuring secure storage and transmission of transaction accounts on NFC-enabled devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional NFC payment systems store transaction account data on NFC-enabled devices, then payment functionality is enabled, but security vulnerabilities and data compromise risks increase
Solution Approach 1:
The system segments the transaction account data protection by separating the actual account data from the NFC-enabled device storage. Instead of storing sensitive data directly on the device, the system uses a distributed architecture where data is encrypted and stored across multiple secure components including the NFC device, payment system server, and using White Box Cryptography to further segment and protect the cryptographic keys and encrypted data.
Solution Approach 2:
The patent introduces multiple intermediary layers between the NFC-enabled device and the transaction account data. These include encrypted account payloads, White Box Cryptography modules, and payment system servers that act as mediators. The intermediaries ensure that even if one component is compromised, the actual transaction data remains protected through layered encryption and secure architecture.
2Reliability
If manual encryption processes are used for account provisioning, then security can be maintained, but user input requirements increase and processing speed decreases
Solution Approach 1:
The system implements self-service automation where the payment system server automatically performs encryption, decryption, and key management operations without requiring manual user intervention. The NFC-enabled device automatically receives encrypted account payloads and the system autonomously manages the cryptographic operations, eliminating the need for users to manually encrypt data while maintaining security through automated secure processes.
Solution Approach 2:
The patent changes the parameters of the encryption process by implementing automated key generation and management systems. Instead of static manual encryption, the system dynamically generates encryption keys, manages key lifecycles, and adapts encryption parameters automatically. This transforms the encryption process from a manual, time-consuming operation to an automated, high-speed process that maintains or enhances security while improving processing speed.
3Reliability
If multiple encryption keys are generated and managed manually, then data security is enhanced, but device complexity and energy consumption increase
Solution Approach 1:
The patent introduces a payment system server as an intermediary that centralizes the complex task of generating, managing, and distributing multiple encryption keys. Instead of each NFC-enabled device independently managing multiple keys (which would increase device complexity), the server acts as a centralized key management authority that handles the complexity remotely, allowing devices to use simplified key storage and management while maintaining enhanced security through multiple encrypted keys.
Data Source
AI summary
Systems, methods, and articles of manufacture for secured account provisioning and payments using user computing devices are provided. One such method comprises receiving, by a user computing device, a payment request from a point of sale terminal; obtaining, by the user computing device, a storage encryption (ENC) key based on at least a device fingerprint of the user computing device and a storage root key; obtaining, by the user computing device, an encrypted account payload from a secure database of the user computing device; decrypting, by the user computing device, the encrypted account payload using the storage ENC key, wherein the decrypted account payload includes a payment credential; and transmitting, by the user computing device, the payment credential to the point-of-sale terminal.