Contactless Card Authentication Using NFC Token and Risk Analytics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing contactless card authentication methods are vulnerable to attacks and do not adequately verify the physical presence of the card owner, compromising transaction security and integrity.
Innovation Solution
A system that uses a physical token on the contactless card, requiring the card owner to authenticate transactions via a mobile app and scan the token, with a counter value verification mechanism to ensure the card's presence and authorize transactions, adjusting authentication strength based on risk profiles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional email or SMS verification is used for transaction authentication, then transaction verification can be performed, but the system is vulnerable to attacks and does not provide sufficient security
Solution Approach 1:
The authentication system is segmented into multiple independent components: a physical token on the contactless card, a mobile device with authentication app, and server-side verification. This segmentation ensures that no single component contains all authentication credentials, making the system more resistant to attacks.
Solution Approach 2:
A mobile device acts as an intermediary between the contactless card and the transaction system. The mobile device reads the physical token, performs authentication through an app, and communicates with the server, adding a secure intermediate layer that prevents direct exposure of sensitive authentication data.
2Ease of operation
If the card is kept with the mobile device for convenient access, then ease of operation improves, but a fraudulent actor may possess the device used to authenticate transactions
Solution Approach 1:
The authentication credentials are segmented between the physical token on the card and the authentication app on the mobile device. Both components are required together for authentication, so even if a fraudulent actor obtains one, they cannot compromise the entire authentication system.
Solution Approach 2:
Different security functions are assigned to different locations: the physical token resides locally on the contactless card for proving physical possession, while the authentication app resides on the mobile device for processing authentication logic. This distribution of security functions enhances overall system security.
3Reliability
If dynamic risk-based authentication is implemented, then transaction security improves by adapting to risk profiles, but device complexity increases
Solution Approach 1:
The authentication system dynamically adjusts its behavior based on risk assessment. The server evaluates transaction risk factors and dynamically determines the appropriate authentication level, transitioning between different authentication modes without requiring multiple separate systems.
Solution Approach 2:
The mobile device with the authentication app serves multiple functions: it reads the physical token, performs authentication operations, communicates with the server, and adapts to different risk levels. This multi-functionality reduces the need for separate dedicated devices for each authentication scenario.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
Example embodiments provide systems and methods for validating an action using a physical token, such as a near-field-communications (NFC)-capable chip. A server may receive a request to perform the action, and may require validation from the holder of the physical token. The holder of the physical token may log into an application using their log-in credentials, providing a first tier of authentication. The holder may then scan the physical token with a reader on their mobile device, which provides a second tier of authentication. The scan may reveal a value for a counter on the physical token, which may be compared to a counter at the server in order to validate that the physical token has been used as expected. If the server deems it appropriate, a third (or further) tier may be required, such as scanning a photographic identification of the holder.