Distributed Once Card Number Generation for Fraud Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current credit card technologies fail to effectively prevent fraud, particularly due to the vulnerability of credit card numbers to leakage and misuse, especially in offline transactions and centralized secure database attacks.
Innovation Solution
A distributed once card number (OCN) generation and validation method and apparatus that generates a new, unpredictable OCN for each transaction, using a card with a built-in generator and magnetic stripe emulator, and a validation server that relies on hashing values to authenticate transactions without storing sensitive user information, thereby reducing the risk of fraud.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized secure database stores user secret seeds for generating virtual account numbers, then authentication can be performed, but the system becomes vulnerable to centralized database attack fraud where hackers can automatically generate all valid VANs
Solution Approach 1:
The patent extracts the secret seed from the centralized server and stores it locally in the smartcard. The server only retains public information and validation logic, while the private key remains distributed to individual cards. This extraction eliminates the single point of failure in centralized databases while maintaining authentication capability through distributed key pairs.
Solution Approach 2:
The authentication system is segmented into multiple independent components: each smartcard contains its own private key and can independently generate virtual account numbers. The server segments its role to only validate signatures and check usage status, rather than storing all sensitive data centrally. This segmentation distributes security risk across many independent units.
2Ease of operation
If a predictable pseudo random generator with user secret seed is used for generating virtual account numbers, then authentication is enabled, but offline batch transactions cannot be handled if card numbers are out of order by more than 5 sequences
Solution Approach 1:
The patent introduces a cryptographic signature as an intermediary mechanism that decouples the generation and validation processes. The smartcard signs the virtual account number and usage status, allowing the server to validate any out-of-order transaction without needing to track sequence numbers. This intermediary signature provides universal validation capability regardless of transaction order.
Solution Approach 2:
The system changes from sequence-number-based validation to cryptographic signature-based validation. Instead of checking if a virtual account number falls within a predictable sequence range, the server verifies the cryptographic signature and checks a usage status flag. This parameter change enables handling of arbitrarily ordered transactions including offline batch processing.
3Productivity
If credit card numbers are stored and transmitted in traditional formats, then transactions can be processed through existing infrastructure, but the numbers are vulnerable to leakage and skimming fraud
Solution Approach 1:
The patent creates a cryptographic copy mechanism where the smartcard contains the original private key and can generate multiple valid virtual account number copies. Each virtual account number is a legitimate copy that can be used once, then becomes invalid. This copying approach maintains compatibility with existing card readers while eliminating the risk of reuse fraud.
Solution Approach 2:
The virtual account number is designed as a disposable, single-use credential. Once used for a transaction, it is immediately invalidated in the database. This short-lived credential approach replaces the long-lived traditional card number, making it economically irrational for fraudsters to attempt skimming or theft since the stolen number cannot be reused.
4Reliability
If the validation server stores complete user information including secret seeds, then comprehensive authentication can be performed, but the risk of centralized secure database attack fraud increases dramatically
Solution Approach 1:
The patent extracts sensitive secret data (private keys and secret seeds) from the centralized server and stores it locally in individual smartcards. The server only stores public information such as user identifiers, public keys, and usage status flags. This extraction maintains authentication capability while eliminating the high-value target that attracts centralized database attacks.
Solution Approach 2:
The system performs preliminary cryptographic key pair generation during card provisioning, storing the private key in the card and public key in the database before any transactions occur. This preliminary action establishes a trust architecture where the server never needs to store or process secret materials, reducing the attack surface from the outset.
Data Source
AI summary
A once card transaction system comprises a once card embedded with a once card number generator. The embedded once card number generator is able to communicate a once card number with a swipe card reader through the magnetic stripe emulator interface on the back of the card for in-store transaction or display it at the front of the card for online transaction. The embedded once card number generator is capable of generating an unpredictable once card number inside the once card without communicating with a central server. This distributedly generated once card number can be approved by an authentication entity by a valid OCN hashing list, and once the number is transacted, it is put on a rejection list.