Offline Contactless Payment Authentication Using OS-Provided Decryption Ciphers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current contactless payment transaction authentication methods require internet connectivity, leading to latency and inconvenience, and cannot store PINs on customer devices without hardware-backed secured storage, violating security standards.
Innovation Solution
A system that decrypts a transaction PIN stored in an encrypted form locally on a customer device using a cipher received from the operating system, allowing offline authentication without server communication, and uses the PIN to access a token for processing payments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PIN is stored on customer mobile device, then authentication can be performed offline, but security standards (PCI DSS) are violated
Solution Approach 1:
The system segments the authentication process into two parts: the PIN remains encrypted and stored locally on the device, while the decryption key (cipher) is provided by the operating system's secure authentication mechanism. This segmentation allows the PIN to be stored locally without violating security standards, as the actual decryption capability is controlled by the OS's secure environment.
Solution Approach 2:
The operating system's authentication mechanism acts as an intermediary between the stored encrypted PIN and the decryption process. When the customer provides biometric authentication or other secure credentials to the OS, the OS generates or retrieves the cipher and provides it to the application. This intermediary role ensures that the PIN storage complies with security standards while still enabling offline authentication.
2Reliability
If server communication is required for authentication, then security can be maintained, but transaction latency increases
Solution Approach 1:
The system performs preliminary actions by storing the PIN in encrypted form locally on the customer's mobile device before any transaction occurs. The encryption is done in advance using a cipher that will be provided by the operating system when needed. This preliminary setup eliminates the need for real-time server communication during the actual transaction, reducing latency while maintaining security through the pre-established encrypted storage.
Solution Approach 2:
The mobile device performs self-service authentication by locally decrypting the PIN using the cipher provided by the operating system's authentication mechanism. The device does not need to contact external servers for authentication, as it has all the necessary components (encrypted PIN storage and OS-provided cipher) to perform the authentication independently and instantly.
3Reliability
If internet connection is required for authentication, then transaction security can be verified, but customer convenience deteriorates
Solution Approach 1:
The system extracts the essential authentication functionality from the server-dependent model and implements it locally on the customer's mobile device. By storing the encrypted PIN locally and using the operating system's secure authentication mechanism to provide the decryption cipher, the system removes the mandatory requirement for internet connection and server communication, thereby improving customer convenience while maintaining transaction verification security.
Data Source
AI summary
An application system for authenticating a contactless payment transaction is described, the application system comprising: (i) a verification module configured to receive, from an operating system, a cipher if a customer is authenticated; and (ii) an access module configured to: (a) instruct the operating system to use the cipher to decrypt a transaction personal identification number (PIN) which is stored in a local database in an encrypted form; (b) receive the transaction PIN once decrypted; and (c) use the transaction PIN to access a token, the token being associated with payment details for processing the payment transaction.