Offline Access Token Generation via Local Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authorization systems face challenges in securely transmitting credentials, particularly when encryption is required, as it disrupts routing and can lead to interoperability issues and token exhaustion, and existing tokenization methods complicate offline access and device compatibility.
Innovation Solution
Implementing offline token provisioning where user devices generate and share access tokens based on a primary access identifier, variable value, and salt, allowing for offline use and diverse token creation without relying on a remote server, thus ensuring compatibility and preventing token exhaustion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials are encrypted to prevent eavesdropping, then security is improved, but routing capability deteriorates because leading digits change
Solution Approach 1:
The credential is segmented into two parts: an encrypted portion for security and a plaintext routing portion for routing capability. This allows the credential to simultaneously provide both security through encryption and routing functionality through the unencrypted leading digits that identify the authorization computer.
Solution Approach 2:
A token is introduced as an intermediary element that replaces the full credential in authorization requests. The token contains an encrypted portion for security and a routing portion that preserves routing capability, allowing the system to maintain both security and routing without directly encrypting the entire credential.
2Device complexity
If tokens are generated and stored on a remote server, then token management is centralized, but offline access deteriorates and device compatibility issues arise
Solution Approach 1:
User devices are empowered to generate their own tokens locally using stored credential information, eliminating the need for continuous communication with the remote server. This self-service capability enables offline access while maintaining token security through local generation using the encrypted credential portion.
Solution Approach 2:
The token generation capability is made universal across multiple user devices by storing the credential information locally on each device. Each device can independently generate tokens, making the system adaptable to various devices including mobile phones, tablets, and computers without requiring device-specific provisioning.
3Quantity of substance
If a finite number of tokens are generated, then token exhaustion occurs, but unlimited token generation compromises security
Solution Approach 1:
The token system transitions from static pre-generated tokens to dynamic on-demand generation. Tokens are generated locally on user devices as needed using the stored credential information, allowing unlimited token quantity while maintaining security through the encrypted credential portion that prevents unauthorized token generation.
Data Source
AI summary
A system and method are provided for generating access tokens on a user device rather than via a remote server computer. An access token can be generated on a second user device by combining and encrypting, with format preservation, a primary access identifier, variable value, and salt. The resulting value can be provided to a first user device that subsequently can provide the access token to an access device as a part of an interaction. The access device can generate an authorization request message that includes the access token and transmit the authorization request message to a remote server computer for processing. The remote server computer can process the access token to determine the primary access identifier despite not being involved in the generation of the access token, providing an improvement over conventional tokenization methods.