NFT-Based Account Authentication Without PIN Entry Hardware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Consumers face challenges with remembering multiple personal identification numbers (PINs) for different cards and PINs are prone to attacks, while PIN entry systems are costly to implement and maintain on merchant devices.
Innovation Solution
Authentication using a non-fungible token (NFT) to verify account ownership, eliminating the need for PIN entry by linking a unique identifier with an NFT through a blockchain, ensuring secure and cost-effective transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PIN entry is used for authentication, then account security is improved, but device cost and complexity increase due to PCI certification requirements
Solution Approach 1:
The patent extracts the authentication function from the PIN entry system and relocates it to a mobile device. The mobile device independently generates and verifies authentication codes using its secure element, removing the burden of PCI certification from merchant devices while maintaining security through cryptographic verification of the authentication code against the transaction amount
Solution Approach 2:
The patent introduces a mobile device as an intermediary between the payment card and the merchant device. This intermediary handles the authentication process by generating verification codes and communicating with the issuer, thereby eliminating the need for expensive PCI-certified PIN entry hardware at the merchant location
2Adaptability or versatility
If multiple cards with different PINs are issued, then payment versatility is improved, but ease of operation deteriorates due to difficulty in remembering multiple PINs
Solution Approach 1:
The mobile device performs self-service authentication by automatically generating verification codes based on the transaction amount and account credentials stored in its secure element. The user simply presents the mobile device and the system, eliminating the need for manual PIN entry and remembering multiple PINs while maintaining support for multiple payment cards
3Reliability
If PIN entry is required for transactions above threshold, then fraud prevention is improved, but productivity decreases due to additional authentication steps
Solution Approach 1:
The authentication credentials and secure element are pre-configured in the mobile device before the transaction occurs. During the transaction, the verification code is generated and transmitted automatically without requiring the user to manually enter a PIN, thus maintaining fraud prevention through pre-established security while improving transaction speed through automated authentication
Data Source
AI summary
A processor-implemented method may be performed by a server. A method may include: receiving an authentication request from a device, the authentication request including a unique identifier; authenticating the authentication request by: retrieving a non-fungible token (NFT) identifier and public key associated with the unique identifier; identifying, from a blockchain, a blockchain address that is an owner of an NFT represented by the NFT identifier; verifying that the blockchain address that is the owner of the NFT is associated with the public key that is associated with the unique identifier; and verifying that a private key stored in a secure area of the device is associated with the public key that is associated with the unique identifier; and after authenticating the authentication request, enabling an operation not available prior to authenticating the authentication request. The unique identifier may be obtained using image recognition or optical character recognition.