Identity Authentication for Electronic Payments Using Session Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic payment systems are vulnerable to unauthorized use due to limitations in identity authentication, particularly with static passwords and one-time passwords (OTPs) being susceptible to interception and misuse, lacking effective multi-factor authentication to detect and prevent unauthorized terminal device usage.
Innovation Solution
A method and system for identity authentication in electronic payment transactions that generates an authentication data record based on network session parameters, stores it securely, and compares it with transaction records to confirm identity, authorizing payments only when there's a match, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static passwords or OTPs are used for authentication, then the authentication process is simple and convenient, but the system becomes vulnerable to interception and misuse by malicious third parties
Solution Approach 1:
The authentication system is segmented into multiple independent factors: device identification (terminal characteristics), location verification (geographic data), biometric authentication (fingerprint/face recognition), and behavioral analysis (typing patterns). Each factor operates independently and contributes to the overall authentication decision, preventing any single point of failure or interception vulnerability
Solution Approach 2:
The system introduces intermediary verification mechanisms between the user and the payment system. Instead of directly trusting passwords or OTPs, the system uses intermediary factors such as device fingerprints, location services, and biometric scanners to verify identity. These intermediaries act as trusted third parties that cannot be easily intercepted or spoofed
2Reliability
If OTP-based authentication is implemented, then identity verification is improved, but the system remains susceptible to OTP interception en route to or from registered terminal devices
Solution Approach 1:
The system extracts the authentication verification process from the communication channel (where OTPs are vulnerable to interception) and relocates it to the device itself (where biometric and behavioral data reside). The authentication proof is generated locally on the user's device using stored biometric templates and behavioral patterns, eliminating the need to transmit sensitive authentication data over vulnerable networks
Solution Approach 2:
The system transitions from one-dimensional authentication (password or OTP only) to multi-dimensional authentication by adding spatial (location), temporal (behavioral patterns over time), and biological (biometric) dimensions. This dimensional expansion creates a much larger authentication space that is far more difficult for attackers to compromise through traditional interception methods
3Reliability
If multi-factor authentication involving network session parameters and device identification is implemented, then security against unauthorized terminal usage is improved, but the authentication system complexity increases
Solution Approach 1:
The system employs universal authentication mechanisms that serve multiple functions simultaneously. For example, device fingerprinting not only identifies the terminal but also verifies its registered status; location verification not only confirms geographic position but also detects anomalies in travel patterns; biometric authentication not only verifies identity but also provides liveness detection. This multi-functionality reduces the need for separate complex systems for each authentication factor
Data Source
AI summary
The disclosure relates to identity authentication in electronic payment transactions. The disclosure comprises (i) receiving an identity authentication request responsive to a request for electronic payment initiated in a network session between a client terminal and a merchant server, (ii) receiving the payor account, the payee account and a payment amount, (iii) receiving session data parameters corresponding to a network communication session, (iv) generating an authentication data record based on the session data parameters, (v) transmitting the generated authentication data record to a terminal device associated with the identified payor account, (vi) retrieving from the client terminal, data record(s) associated with electronic payment transactions involving the client terminal, (vii) comparing the data records retrieved from the client terminal against the generated authentication data record, and (viii) responsive to a match between a data record retrieved from the client terminal against the generated authentication data record, generating an identity confirmation decision.