Secure PIN Entry via Segmented Conversion and Physical Capture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing the entry of confidential alphanumeric codes on unsecured devices, such as mobile terminals, are insufficient in preventing spying and do not ensure a high enough level of security, particularly when using techniques like RevoPIN that generate single-use virtual keyboards.
Innovation Solution
A method that converts a portion of the alphanumeric code into a converted code using a single-use conversion table, separating the conversion and entry processes across two devices, ensuring that neither device has access to both the original code and the conversion means, thereby enhancing security by preventing deduction of the original code from observed converted codes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single-use virtual keyboard is used to convert the PIN code, then the code transmission security is improved, but the system becomes vulnerable to malicious applications that can access both the swapped code and virtual keyboard information on the mobile terminal
Solution Approach 1:
The system divides the code security process into two separate devices: the mobile terminal performs code conversion using a virtual keyboard, while a separate payment accessory (second device) captures the physical key presses. This segmentation ensures that no single device has access to both the conversion key and the entered code, eliminating the spying vulnerability.
Solution Approach 2:
The patent introduces an intermediary device (payment accessory/reader) that physically captures key presses without electronic access to the mobile terminal's memory or processing. This intermediary acts as a trusted bridge that collects input data through a different modality (physical pressing detection) than the virtual keyboard display, preventing malicious applications from correlating the two data types.
2Device complexity
If the conversion and entry processes are performed on the same device, then the system complexity is reduced, but the security level is insufficient to prevent code deduction
Solution Approach 1:
The system deliberately increases device complexity by separating the conversion function (mobile terminal with virtual keyboard) from the entry function (payment accessory with physical key detection). This segmentation, while adding device complexity, is necessary to achieve the required security level where neither device can independently deduce the original PIN code.
3Ease of manufacture
If a payment accessory connected to mobile terminal is used, then the cost is reduced and ease of use is improved, but the security level for confidential code entry is insufficient
Solution Approach 1:
The payment accessory serves as a specialized intermediary device that bridges the low-cost mobile terminal environment with high-security code entry requirements. It implements physical key press detection capabilities that are independent of the mobile terminal's software environment, providing security through hardware-based input capture while maintaining compatibility with existing mobile payment infrastructure.
Data Source
Figure 1~2
Figure 3~4
AI summary
The method involves obtaining (20) converter for converting portion of alphanumerical code into one portion of converted code, through a first device. The information is obtained for identifying converter. The portion of converted code is entered (21) into a second device distinct from first device. The portion of converted code and information are transmitted for identifying converter towards secured server. Independent claims are included for the following: (1) a computer-readable and non-transitory storage medium storing computer program for securing entry of alphanumerical code; (2) a device for securing entry of alphanumerical code by user; and (3) a payment accessory.