One-Time Encryption Keys for Secure Transaction Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity measures in cyberspace transactions fail to effectively identify and verify parties involved in transactions, leading to vulnerabilities and increased costs due to fraud and security breaches, as they do not adequately ensure the presence and agreement of participants, nor securely store transaction records.
Innovation Solution
A system utilizing one-time-use encryption keys generated by unique sequencers on user and provider devices, managed by an intermediate entity, to encrypt transaction data, ensuring secure identification and authorization without exposing personal or financial information, and maintaining records centrally to prevent data breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity measures (passwords, encryption) are used to protect transactions, then security is partially improved, but fraud and security breaches still occur, leading to increased costs and loss of information
Solution Approach 1:
The system segments the authentication process into two independent parts: the user generates a one-time authorization code on their device, and the service provider independently generates a verification code. These separate codes are then matched by an intermediary (bank) without either party having access to the other's private key or sensitive information. This segmentation prevents single points of failure and eliminates the need for providers to store sensitive user data.
Solution Approach 2:
The user's device performs preliminary encryption and code generation before transmitting any sensitive information to the service provider. The one-time authorization code is generated and encrypted locally on the user's device, and only the encrypted result is transmitted. This preliminary action ensures that sensitive data never leaves the user's device in plaintext form, preventing interception and fraud.
2Ease of operation
If service providers store and process user personal and financial information, then transaction processing is enabled, but security risks and storage costs increase, and data breaches can occur
Solution Approach 1:
The system extracts and removes sensitive personal and financial information from the service provider's environment. Instead of storing user data, the provider only receives and processes one-time authorization codes that are mathematically linked to user accounts through the bank's records. The actual sensitive information remains exclusively stored in the bank's secure environment, eliminating the provider's security liability while maintaining transaction processing capability.
Solution Approach 2:
The bank acts as an intermediary that holds the connecting information between users and service providers. The bank stores the relationship between user accounts and their corresponding one-time codes, but neither the user nor the provider has access to the other's sensitive information. This intermediary structure enables transaction processing while minimizing the attack surface for security breaches.
3Loss of information
If multiple parties store copies of transaction data for record-keeping, then data availability is improved, but storage costs and security vulnerabilities increase
Solution Approach 1:
The system extracts the need for service providers to store transaction data. Instead of maintaining local copies of sensitive information, providers only store minimal transaction metadata (such as transaction IDs and timestamps) while all authoritative records are maintained centrally by the bank. This reduces storage costs and eliminates the security burden of protecting distributed data copies while ensuring data availability through centralized record-keeping.
Data Source
AI summary
A registered provider device encrypts provider input related to a transaction between the provider device and one of many registered user devices to create an encrypted one-time-use provider code (the encryption is performed using an encryption key produced, in part, using a uniquely sequenced number generated by a sequencer maintained by the provider device). Similarly, the user device encrypts user input to create an encrypted one-time-use user code using an encryption key produced, in part, using a uniquely sequenced number generated by a user sequencer maintained by the user device. The provider and user devices independently transmit their different encrypted one-time-use codes to an intermediate entity, which decrypts the encrypted codes. This decryption is performed using one-time-use encryption keys produced using sequencers maintained by the intermediate entity, and this decryption generates an authorization request. The intermediate entity obtains an authorization decision regarding the authorization request from the authorization entity.