Payment Authentication Using Offline TOTP Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dynamic authentication systems for electronic payment transactions require constant communication with a central server, exposing sensitive information to interception and creating points of failure, and are vulnerable to man-in-the-middle attacks, while traditional static methods lack robustness against evolving cyber threats.
Innovation Solution
A system that generates and manages dynamic authentication codes using time-based one-time passwords (TOTPs) locally on user devices, ensuring secure storage and offline capability, with a centralized platform for verification, and includes a fallback mechanism for static authentication in case of unavailability, implemented across multiple geographic regions for high availability and disaster recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic authentication codes are generated using centralized server communication, then authentication security is improved, but vulnerability to interception and points of failure increases
Solution Approach 1:
The patent extracts the authentication code generation capability from the centralized server and implements it locally on user devices. The system generates dynamic authentication codes using locally stored cryptographic keys and time-based algorithms (TOTP), eliminating the need for continuous server communication during authentication. This extraction removes the vulnerability point where intercepted communications could compromise security, while maintaining strong authentication through local cryptographic operations.
2Measurement precision
If constant communication with central server is implemented, then authentication verification is improved, but system reliability deteriorates due to network dependency
Solution Approach 1:
The patent implements preliminary action by pre-synchronizing time-based authentication parameters between the user device and the central server during setup. The system stores cryptographic keys and configuration data locally, enabling the device to independently generate valid authentication codes without real-time server connection. This preliminary preparation ensures both verification accuracy (through pre-shared secrets) and system reliability (through offline capability).
Solution Approach 2:
The user device performs self-service authentication by independently generating and validating authentication codes using locally stored cryptographic materials. The device autonomously computes TOTP codes based on its internal clock and pre-configured keys, without requiring continuous server intervention. This self-service approach maintains verification accuracy through cryptographic validation while eliminating network dependency for system availability.
3Reliability
If encrypted data items are stored centrally, then data security is improved, but system complexity increases
Solution Approach 1:
The patent segments the authentication system into distinct functional components: the central server stores only minimal authentication metadata and encrypted configuration data, while the user device holds the primary cryptographic keys and generation logic. This segmentation reduces central system complexity by distributing cryptographic responsibilities, while maintaining data confidentiality through encrypted storage of sensitive parameters on both ends.
Data Source
AI summary
A system for dynamic authentication of payment transactions comprises a first computing system communicatively coupled to a computer communications network. The first computing system receives an activation request for a payment instrument from a second computing system, generates and transmits an activation token to the second system, receives an encrypted data item from the second system, and stores the encrypted data item with a payment instrument identifier. During a transaction, the first system receives a verification request with a dynamic authentication code from a payment issuer, retrieves the stored encrypted data item, validates the dynamic code using the data item, and transmits a verification result to the issuer indicating whether the transaction is authenticated based on the validation outcome. The system enables secure dynamic authentication without requiring constant communication between devices.