Payment Terminal Public-Key Verification Without Card Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Payment cards are susceptible to fraud due to the exposure of sensitive information like card numbers and PINs, necessitating a more secure system for verifying payment validity.
Innovation Solution
A payment terminal system utilizing a Public-Private key pair, where a payment token with a public key is transmitted via NFC or RFID, verified by a backend platform, and confirmed using the corresponding private key for secure transaction authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If card number and PIN are transmitted for verification, then payment verification can be completed, but the system becomes vulnerable to fraud when this information is exposed
Solution Approach 1:
The patent extracts the sensitive card number and PIN from the transmission process entirely. Instead of transmitting these secret credentials, the system uses a public key that can be freely transmitted without compromising security. The private key remains securely stored in the payment terminal, never leaving the device.
Solution Approach 2:
The patent introduces a public key as an intermediary element that mediates between the payment terminal and the verification system. This public key serves as a safe intermediary that carries identifying information without exposing sensitive secrets, allowing verification to proceed without direct exposure of the private key or card details.
2Reliability
If a more secure verification system is implemented using public-private key pairs, then fraud resistance improves, but device complexity increases
Solution Approach 1:
The payment terminal automatically generates its own public-private key pair and manages the cryptographic operations autonomously. The terminal itself performs the signing operations using its private key and verifies signatures using its public key, eliminating the need for external key management infrastructure.
Solution Approach 2:
The system implements only the essential cryptographic functions needed for verification - generating key pairs, signing transactions, and verifying signatures. It does not implement the full complexity of cryptographic protocols, focusing only on the minimum necessary actions to achieve fraud prevention.
Data Source
AI summary
A payment terminal comprising one or more tangible computer-readable non-transitory storage media comprising program instructions for verifying payment validity, wherein execution of the program instructions by one or more processors cause the payment terminal to: receive a payment token issued by a software development kit (SDK) located at a wireless device, wherein the payment token includes a first public key of a pair of Public-Private keys and a consumer identifying information; generate a payment request including transaction information message and transmit said first payment request message and said payment token to an at least one back-end platform to be stored in at least one database; and receive the payment and a transaction confirmation message from said at least one back-end platform based on a payment approval generated by said at least one back-end platform, wherein verifying ownership of said first public key is done at least one back-end platform based on comparison of the public key of the signed transaction information message and said public key of the payment token.