Offline Authentication Using PKI and Visual Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods face challenges in securely transmitting sensitive data offline due to potential interception by fraudsters and transmission delays, especially in high-volume, fast-paced systems like transit terminals, where conventional encryption methods are inadequate.
Innovation Solution
A method and device for offline authentication that uses a public key infrastructure (PKI) to securely convert sensitive data into a visual or audio code, allowing offline validation using elliptic-curve cryptography to verify the authenticity of the data without requiring significant infrastructure updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitive data is transmitted from user device to access device, then authentication can be performed, but security is compromised due to potential interception by fraudsters
Solution Approach 1:
The patent extracts the sensitive authentication data from the transmission channel by implementing offline authentication where the access device performs verification locally using stored credentials and cryptographic keys, eliminating the need to transmit sensitive data over communication channels that could be intercepted by fraudsters
Solution Approach 2:
The patent introduces cryptographic intermediaries (digital certificates, public/private key pairs, and authentication tokens) that mediate the authentication process. These intermediaries enable secure verification without exposing sensitive data, as the access device validates credentials through cryptographic proof rather than direct data transmission
2Reliability
If conventional encryption methods are used to protect sensitive data, then security is improved, but transmission delay increases and infrastructure updates are required
Solution Approach 1:
The patent implements preliminary action by pre-provisioning the access device with authentication credentials, public keys, and verification algorithms during system setup. This allows the access device to perform offline authentication immediately without needing to request or receive cryptographic materials during the authentication transaction, eliminating transmission delay
Solution Approach 2:
The patent employs disposable authentication tokens and single-use credentials that are generated and consumed in the offline authentication process. These temporary cryptographic objects enable secure authentication without requiring long-term infrastructure changes or complex key management systems
3Loss of information
If sensitive data is transmitted in large size, then authentication information is complete, but transmission efficiency decreases and security risks increase
Solution Approach 1:
The patent extracts only the essential authentication elements (public keys, digital certificates, and verification algorithms) from the complete authentication dataset and provisions them in advance at the access device. This extraction eliminates the need to transmit large volumes of sensitive authentication data during offline transactions, maintaining information completeness while dramatically improving transmission efficiency
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are disclosed for securely communicating sensitive data (e.g., interaction data) during a process for offline authentication. A data packet may be received by an access device from a user device in a one-way communication. The data packet may be converted to obtain interaction data comprising a digital certificate certified by the certificate authority and a digital signature value generated by the user device. A second public key associated with the user device may be obtained utilizing the digital certificate and the first public key associated with the certificate authority. The validity of the interaction data may be determined based at least in part on the digital signature value and the second public key associated with the user device. When the interaction data is determined to be valid, an identifier of the interaction data may be authorized and access may be provided based on this authorization.