Payment Terminal Fraud Detection via Attestation Tickets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Payment terminals are vulnerable to fraudulent activities and tampering, with attackers attempting to access payment information, eavesdrop on signals, or modify communications, and counterfeit payment cards being used to bypass security measures.
Innovation Solution
Implementing an augmented tamper and fraud detection methodology that includes a trust routine within the payment platform, using trust commands to attest the security of the payment entity, generating an attestation ticket based on reliably measured data, and continuously validating the platform's integrity to ensure secure transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional tamper switches or tamper meshes are used to detect physical access attempts, then basic security protection is provided, but sophisticated attackers can bypass these measures or perform attacks without physical access
Solution Approach 1:
The patent replaces traditional mechanical tamper detection systems (tamper switches, tamper meshes) with a logical validation system that uses software-based trust commands and attestation tickets to detect tampering. This substitution allows detection without physical access requirements, addressing the bypass capability issue.
Solution Approach 2:
The patent introduces a payment processing system as an intermediary that receives trust commands from a trusted party, executes validation logic, and issues attestation tickets to payment terminals. This intermediary layer enables remote validation without requiring direct physical access to the terminal's tamper detection mechanisms.
2Reliability
If payment terminals continuously monitor for tampering to improve security, then detection capability increases, but system complexity and processing overhead increase
Solution Approach 1:
The patent implements preliminary action by having the payment terminal continuously execute trust commands and monitor for tampering conditions in the background, without requiring active validation requests for each transaction. The terminal maintains a current state of validation that can be quickly referenced during transactions.
Solution Approach 2:
The system uses feedback mechanisms where the payment terminal reports its validation state to the payment processing system, which then issues attestation tickets valid for a period of time. This feedback loop allows continuous monitoring while reducing the need for repeated validation checks during normal operation.
3Measurement precision
If multiple validation checks are performed to ensure payment terminal security, then fraud detection accuracy improves, but transaction processing time increases
Solution Approach 1:
The patent performs validation checks in advance by continuously executing trust commands and obtaining attestation tickets before transactions occur. The payment terminal maintains a current validation state that is pre-established, allowing rapid reference during transaction processing without repeating all validation checks.
Solution Approach 2:
The system performs partial validation by using attestation tickets that are valid for a period of time, reducing the need to perform complete validation checks for every transaction. The terminal can reference the pre-obtained validation state rather than re-executing all trust commands with each transaction.
Data Source
AI summary
Disclosed herein is a method and system to determine whether a payment terminal has been tampered with based on a comparison of attestation data received from the payment terminal. If the determination yields that the request has been approved, the terminal generates an attestation ticket having one or more validity conditions, wherein the validity conditions include expiration time that indicates the time after which the attestation ticket becomes invalid. The attestation ticket can be used as long as it is valid or until another trigger causes the ticket to be invalidated or regenerated.