OTP Card Personalization with Offline Parallel Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems require network communication between card manufacturing and validation entities for encryption parameter sharing, posing security risks and inefficiencies in the personalization and validation processes of one-time-password authentication cards.
Innovation Solution
A system and method for parallelized encryption and personalization at a card manufacturer HSM and decryption and validation at an independent card validator HSM, using a shared-secret master key to generate unique secret identifiers, enabling independent decryption and validation without network communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If card personalization records are communicated to validation entity during personalization phase, then validation can be enabled, but network exposure of critical encryption parameters occurs
Solution Approach 1:
The system segments the cryptographic key material into two separate components: a master key stored in the HSM and a card-specific secret stored on the card. This segmentation allows validation to occur without transmitting the master key over the network, as the validation entity can independently generate the card-specific secret using only the master key and card identifier, eliminating network exposure of critical encryption parameters while maintaining validation capability
Solution Approach 2:
The system performs preliminary generation of card-specific cryptographic parameters during card personalization and stores them securely on the card itself. This preliminary action enables the validation entity to independently derive the same parameters using only public information (card identifier) and the master key, eliminating the need for subsequent network communication of sensitive parameters
2Reliability
If sequential personalization and validation processes are used, then security is maintained, but processing efficiency is reduced
Solution Approach 1:
The validation entity performs preliminary setup by storing the master key and validation algorithms in advance. During card personalization, the card-specific secrets are generated and stored on the card itself. This preliminary configuration enables parallel processing where multiple cards can be personalized simultaneously without requiring sequential validation steps, as each card contains all necessary validation data
Solution Approach 2:
The card itself serves as a self-contained validation repository by storing card-specific cryptographic parameters during personalization. This self-service approach eliminates the need for the validation entity to sequentially process personalization records for each card, as validation can be performed independently using only the card's stored data and the master key
Data Source
AI summary
The disclosed system and method are directed to a novel implementation of encryption service provision which obviates a need for network communication between a card manufacturing/personalization entity and a validation entity during the card personalization phase. The proposed solution decouples the operation flow associated with personalization of an OTP card (as carried out by a manufacturing HSM) and the validation of an OTP card cryptogram (as carried out by a distinct validation HSM). This is accomplished by the generation and distribution of a third master key which enables the personalization and the validation HSMs to independently derive the shared secret value used in generation and validation of a transaction cryptogram associated with an OTP card operation.