Secure NFC Transaction Hashing via Mobile Device
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing transactions using mobile devices lack robustness in protecting user passwords from interception and man-in-the-middle attacks, particularly during near-field communication (NFC) transactions.
Innovation Solution
A method utilizing a user's mobile device to generate a cryptographic hash using their password and timestamp, which is then securely transmitted to a point of transaction device and verified by an authorization agent, ensuring that the password is never exposed to potential interceptors and providing an additional layer of security through embedded data known to both the user and the authorization agent.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user's mobile device transmits a password directly during NFC transaction, then the transaction can be authenticated, but the password becomes vulnerable to interception and man-in-the-middle attacks
Solution Approach 1:
The patent introduces a cryptographic hash function as an intermediary mechanism. Instead of transmitting the password directly, the system transforms the password into a hash value that serves as a secure mediator for authentication. This hash function acts as a one-way transformer that preserves authentication capability while eliminating the security vulnerability of direct password transmission.
Solution Approach 2:
The patent transforms the password parameter through a cryptographic hash function, changing its form from a human-readable secret to a fixed-length hash value. This parameter transformation maintains the unique identification capability needed for authentication while making the transformed parameter resistant to interception and reverse-engineering attacks.
2Object-affected harmful factors
If cryptographic hash is used to protect password during transaction, then security against interception is improved, but the transaction process becomes more complex
Solution Approach 1:
The mobile device performs the cryptographic hash computation autonomously using its own processor and stored password. The system leverages the device's existing computational resources to generate the hash value without requiring external hashing infrastructure, thereby minimizing added complexity while achieving enhanced security.
Solution Approach 2:
The password is transformed into a hash value in advance, before the actual transaction communication occurs. This preliminary transformation prepares the authentication data in a secure format, simplifying the subsequent transaction process as the hash value can be transmitted and verified without requiring complex real-time cryptographic operations during the transaction itself.
Data Source
AI summary
A method, system or computer usable program product for secure short range protocol based transaction processing including using a mobile device capable of short range protocol communication to receive a user password; exchanging transaction data between the mobile device and a point of transaction device through a short range protocol communication, the transaction data including a timestamp; using the mobile device, generating a hash including the user password and the timestamp as inputs; providing the hash and the timestamp to an authorization agent; and receiving an authorization from the authorization agent for an account transaction with the point of transaction device based on the password in the hash.