OTP Authentication Cryptogram Using User PIN Diversification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing OTP authentication processes using static and dynamic card-stored encryption data are susceptible to security risks due to network exposure and data breaches, which can compromise the generation and validation of authentication cryptograms.
Innovation Solution
Incorporating user-provided secret data, such as a PIN, into the OTP authentication process by generating a modified Message Authentication Code (MAC) using a diversification function, and encrypting it with unique session keys to enhance security, thereby facilitating a two-factor authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static card-stored encryption data is used for OTP authentication, then authentication process is simplified, but security is compromised due to network exposure and data breach risks
Solution Approach 1:
The authentication system is segmented into multiple independent components: static card-stored data, dynamic runtime-generated data, and user-provided secret data. Each component serves a distinct security function, and the combination of all three is required for successful authentication, thereby maintaining simplicity while enhancing security
Solution Approach 2:
User-provided secret data acts as an intermediary element that bridges the gap between static card data and dynamic runtime data. This intermediary component adds an additional layer of security without complicating the overall authentication flow, as users naturally provide this data during the authentication process
2Device complexity
If only card-stored data is used for cryptogram generation, then device complexity is reduced, but authentication strength is insufficient
Solution Approach 1:
The authentication system is segmented into multiple independent components: static card-stored data, dynamic runtime-generated data, and user-provided secret data. Each component serves a distinct security function, and the combination of all three is required for successful authentication, thereby maintaining simplicity while enhancing security
Solution Approach 2:
The authentication mechanism uses a composite approach by combining three different types of data (static card data, dynamic runtime data, and user-provided secret data) to create a stronger authentication cryptogram. This composite structure enhances authentication strength while keeping the overall system manageable
3Productivity
If encryption data is statically stored on OTP card, then run-time generation is facilitated, but security risks increase from data breaches
Solution Approach 1:
Static encryption data is prepared and stored on the card in advance during personalization, enabling efficient runtime cryptogram generation. Meanwhile, user-provided secret data is collected at runtime to complete the authentication, ensuring that even if static data is compromised, the attacker cannot generate valid cryptograms without the dynamic user input
Solution Approach 2:
The system transitions from purely static card-stored data to a dynamic multi-source data combination. Runtime-generated data and user-provided secret data are integrated with static card data, creating a dynamic authentication process that maintains efficiency while significantly improving security against data breaches
Data Source
AI summary
The disclosed system and method is directed to improving operational security associated with One-Time Password (OTP) authentication card. The disclosed system and method involve incorporating a user-provided data value, such as a Personal Identification Number (PIN) and/or a password, into the cryptographic process flow for the generation of the Message Authentication Code (MAC) associated with an OTP authentication cryptogram. A key operational aspect corresponds to the scrambling of a unique card-stored data such as a shared secret value, with run-time data externally provided by the user. In this way, the disclosed system and method incorporate two factors of identification, associated with card-stored and user-known data elements, into an OTP card authentication cryptogram.