Offline Secure Transaction System Using Encrypted Graphic Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for processing purchase orders and financial transactions require a mobile device to be connected to communication networks, rendering secure transactions impossible when the device is offline due to lack of network access.
Innovation Solution
A server system that facilitates secure offline transactions by receiving an authorization request with a user identifier and secure code, authenticating, and storing the information, allowing transactions between a client device and a POS machine even when the client device is offline through encrypted graphic codes and transaction approvals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the mobile device is connected to communication networks for secure transactions, then transaction security is improved, but transaction availability deteriorates when network access is unavailable
Solution Approach 1:
The system performs preliminary authentication and authorization actions before the actual transaction. The server authenticates the user and device in advance, issues authorization tokens and encrypted graphic codes, and stores transaction information locally on the device. This allows the device to complete transactions offline using pre-established credentials, resolving the contradiction between requiring network connection for security and needing to operate without network access.
2Extent of automation
If the mobile device requires network connection for transaction processing, then central control and security monitoring are improved, but device independence deteriorates
Solution Approach 1:
The system segments the transaction process into multiple independent components: authentication phase (requiring server connection), authorization token generation, local storage of transaction data, and offline execution. The device can independently execute the offline portion using locally stored credentials and encrypted codes, while the server maintains control over authentication and authorization. This segmentation enables both central control and device independence to coexist.
3Productivity
If the system stores comprehensive user financial information on the server, then transaction processing capability is improved, but security risk increases when information is accessed offline
Solution Approach 1:
The system transforms sensitive financial information into different parameter forms: user credentials are hashed, financial account numbers are encrypted, and transaction authorization codes are generated using cryptographic algorithms. The server stores these transformed parameters rather than plain-text sensitive data. When processing offline transactions, the device uses these transformed parameters with encrypted graphic codes, maintaining security while enabling transaction processing capability.
Data Source
AI summary
This application discloses a method implemented at a server to facilitate secure offline transactions. The server receives, from a client device, an authorization request that includes a user identifier, first financial account information and a secure code. The server authenticates the authorization request, and sends a first transaction approval to the client device. Then, in accordance with the information received in the authorization request, the server facilitates a secure transaction between the client device and a point-of-sale (POS) machine while the client device is offline. Specifically, the server receives, from the POS machine, a transaction request that includes at least the user identifier and the security code. The server retrieves the first financial account information from a memory according to the user identifier and the security code, performs a transaction operation associated with the first financial account information, and sends a second transaction approval to the POS machine.