PIN Offset Masking for Secure Character Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for managing personal identification numbers (PINs) associated with financial accounts are inefficient, as customers cannot securely access or modify their PINs online, leading to delays and administrative issues when a PIN is forgotten, and existing methods require costly and time-consuming processes like PIN mailers.
Innovation Solution
A method and system that uses a hardware security module (HSM) and PIN applications to securely disclose and modify PINs by generating PIN offsets and decrypting PIN blocks one character at a time, allowing account holders to access or change their PINs through a secure platform without storing the entire PIN in an unencrypted format.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional PIN management methods are used, then security standards are maintained, but customer access time and administrative costs increase
Solution Approach 1:
The PIN is segmented into individual characters, with only one character decrypted and displayed at a time. The system decrypts PIN characters sequentially rather than displaying the entire PIN at once, allowing customers to retrieve their PIN in stages while maintaining security compliance.
Solution Approach 2:
The system dynamically controls the decryption and display process by decrypting one PIN character at a time based on customer interaction. The decryption state transitions from fully encrypted to partially decrypted in controlled increments, enabling timely access while preserving security.
2Reliability
If PIN mailers are used to deliver new PINs, then security is maintained, but cost and customer convenience deteriorate
Solution Approach 1:
The system enables customers to self-service their PIN retrieval and modification needs through the IVR platform. Customers can independently access their existing PIN or set new PINs without requiring manual intervention from bank staff or physical mailers, eliminating the costs associated with PIN mailer production and delivery.
3Ease of operation
If the entire PIN is decrypted and stored outside HSM, then customer access is simplified, but security compliance is violated
Solution Approach 1:
The PIN is divided into individual character segments, with only one character decrypted at a time in the IVR system. The remaining characters remain encrypted in the HSM, ensuring that no complete unencrypted PIN is stored outside the secure module while still enabling customer access to the full PIN through sequential character revelation.
4Ease of operation
If online PIN access is enabled, then customer convenience improves, but system complexity increases
Solution Approach 1:
The IVR system serves as an intermediary layer between the customer and the HSM. It handles the complex decryption logic by requesting individual PIN characters from the HSM, managing the decryption state, and presenting information to customers in a simple, sequential manner, thereby shielding customers from system complexity while enabling convenient access.
Data Source
AI summary
Securely disclosing a personal identification number (“PIN”) associated with a financial account to an account holder and receiving a new PIN from the account holder. A PIN reveal application can interact with a hardware security module (“HSM”) using a PIN offset masking process and randomly generated account data to reveal the PIN to the account holder one or more PIN characters at a time. A PIN set application also can interact the HSM using a PIN offset masking process and randomly generated account data to receive a new PIN for the account one or more PIN characters at a time. In each of the PIN reveal and PIN setting processes, less than the entirety of the PIN is stored in an unencrypted format outside of the HSM only.