Offline Contactless Payment Authentication via Shared Secret Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing contactless payment systems face challenges in securing transactions, particularly in offline environments without an Internet connection, and lack flexibility in implementing new data security techniques, leading to reduced security and convenience.
Innovation Solution
A method and apparatus that utilize a shared secret and its identifier to generate authentication data through a one-way hash, allowing offline transactions without an Internet connection, and include features for user verification and protection against replay attacks by using Near Field Communication protocols and Fast Identity Online techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If contactless payment transactions are performed without user verification to maintain convenience, then transaction speed and ease of operation are improved, but security level deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-provisioning the payment device with multiple shared secrets and their identifiers before the transaction occurs. During the transaction, the terminal provides a challenge value, and the device selects an appropriate shared secret based on this challenge, generating authentication data in advance prepared fashion. This allows secure offline authentication without requiring real-time internet verification.
2Reliability
If online verification methods are used to improve security, then security level is improved, but transaction time increases due to Internet connection requirements
Solution Approach 1:
The invention extracts the authentication capability from the online verification system by implementing offline authentication using pre-provisioned shared secrets. The payment device contains multiple shared secrets and identifiers locally, allowing it to generate authentication data without contacting the server during the transaction. This extracts the security function from the time-consuming online verification process while maintaining security through cryptographic validation.
3Ease of operation
If contactless payment protocols are used to enable quick transactions, then ease of operation is improved, but flexibility for implementing new security techniques deteriorates
Solution Approach 1:
The system implements dynamic selection of shared secrets based on the challenge value provided by the terminal. The payment device maintains multiple shared secrets and identifiers, selecting the appropriate combination based on the current transaction context. This dynamic approach allows the system to adapt to different security requirements and challenge types while maintaining the speed of contactless transactions, as the selection and authentication occur locally without external communication.
Data Source
AI summary
There is discussed a method of authorising an electronic transaction in which a user device receives a shared secret and a shared secret identifier. Subsequently, on receipt of transaction data from a transaction terminal, the user device calculates a one-way hash of data comprising the shared secret to generate a hash value, generates authentication data comprising the hash value and the shared secret identifier, and transmits the authentication data to the transaction terminal.