PIN Block Encryption Module for Secure SST Network Input
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securely inputting personal identification numbers (PINs) to networks at self-service terminals (SSTs) lack robust encryption and authentication mechanisms, leading to potential interception and unauthorized access.
Innovation Solution
A system that includes an encryption module with a key pad and processors to encrypt PINs into pin blocks using a network encryption key, and employs asymmetric key pairs for secure communication with user devices, ensuring secure transmission and authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption methods are used for PIN transmission, then device complexity is reduced, but security reliability is compromised due to potential interception and unauthorized access
Solution Approach 1:
The system segments the encryption process into multiple distinct stages: initial key exchange using asymmetric encryption, establishment of symmetric session keys, and multiple layers of data encryption. Each stage uses appropriate encryption methods for its specific security requirements, creating a layered security architecture that enhances overall reliability without requiring a single complex encryption system
Solution Approach 2:
The system introduces asymmetric key pairs as an intermediary mechanism to establish secure communication channels before transmitting PINs. The public key acts as a mediator that allows secure key exchange over unsecured networks, while the private key ensures only the intended recipient can decrypt the information. This intermediary layer significantly enhances security without requiring complex point-to-point encryption mechanisms
2Reliability
If robust encryption and authentication mechanisms are implemented, then security against interception is improved, but transaction processing time increases
Solution Approach 1:
The system performs preliminary actions by establishing asymmetric key pairs and secure communication channels before the actual PIN transmission occurs. The initial key exchange and authentication processes are completed in advance, creating a secure tunnel that allows rapid subsequent transactions. This preliminary setup eliminates the need for repeated complex encryption operations during each transaction, reducing overall processing time while maintaining high security
Solution Approach 2:
The system implements periodic re-authentication and key refresh mechanisms that balance security with processing efficiency. By periodically updating session keys and authentication tokens, the system maintains high security without requiring full re-encryption of all transaction data, thus minimizing time loss while ensuring continuous protection against interception
3Reliability
If asymmetric key pairs are used for secure communication, then authentication security is enhanced, but device complexity and computational requirements increase
Solution Approach 1:
The system extracts and separates the asymmetric key pair management functions into dedicated modules within the encryption device. The key generation, storage, and exchange processes are isolated from the main transaction processing logic, allowing independent optimization and management of cryptographic operations. This extraction reduces overall device complexity by creating modular, manageable components rather than a monolithic complex system
Solution Approach 2:
The system inverts the traditional approach by having the encryption device generate and manage its own asymmetric key pairs autonomously, rather than relying on external key management infrastructure. The device independently performs key generation, secure storage, and exchange operations, which simplifies the overall system architecture by eliminating dependency on complex external key management systems while maintaining high authentication security
Data Source
AI summary
A method for inputting pin blocks to a network can include receiving a first pin from a key pad with an encryption module, which is then encrypted to a first pin block with a network encryption key and transmitted to a first computing device that inputs the first pin block to a secure network. The encryption module can also receive a second pin block from a second computing device that is physically separate from the key pad. Prior to receiving the second pin block, the encryption module can transmit a certificate and a second certificate to the second computing device. The encryption module can decrypt the second pin block to a second pin and encrypt the second pin to a third pin block with the network encryption key, for inputting the third pin block to the secure network.