PIN Transaction Security via Chip-Combined ARQC Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transaction authentication methods that use personal identification numbers (PINs) face challenges in protecting PINs from exposure, leading to potential identity theft and fund theft, necessitating a method that minimizes PIN transmission while ensuring secure authentication.
Innovation Solution
A method involving a processor that receives a transaction request, obtains chip information from an embedded chip, combines the PIN with this information to generate a transaction-specific code, and performs a message authentication code (MAC) operation to create an application request cryptogram (ARQC), which is then used to authenticate the transaction without separately transmitting the PIN.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the PIN is transmitted separately during transactions, then authentication can be performed, but the PIN is exposed to potential compromise
Solution Approach 1:
The patent introduces a transaction-specific code as an intermediary that replaces direct PIN transmission. This code is generated by combining the PIN with transaction-specific data (such as transaction amount, merchant ID, timestamp) and passing it through a cryptographic function. The intermediary code conveys authentication information without exposing the actual PIN, thus resolving the contradiction between performing authentication and preventing PIN exposure.
Solution Approach 2:
The patent transforms the static PIN into a dynamic authentication parameter by combining it with variable transaction-specific data. Instead of transmitting the PIN alone, the system creates a transformed parameter (transaction-specific code) that changes with each transaction context. This parameter change ensures that even if the same PIN is used multiple times, the transmitted authentication data remains unique and cannot be reused, thereby enhancing security while maintaining authentication functionality.
2Object-affected harmful factors
If the PIN is combined with chip information to generate a transaction-specific code, then PIN exposure is minimized, but the system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-storing the PIN in secure memory within the card chip and establishing the cryptographic combination logic in advance. The system is pre-configured with the algorithm for combining PIN with transaction data and generating the transaction-specific code. This preliminary setup allows the complex authentication process to execute efficiently during actual transactions without requiring real-time computation of the combination logic, thus reducing the perceived complexity during operation.
Solution Approach 2:
The card chip performs the complex cryptographic operation of combining PIN with transaction-specific data and generating the transaction-specific code autonomously within the card itself. This self-service approach shifts the computational burden from the external terminal to the card's embedded processor, eliminating the need for complex external authentication systems. The card independently generates the secure code, simplifying the overall system architecture while maintaining high security standards.
Data Source
AI summary
A method for authenticating a transaction that requires the use of a personal identification number (PIN) is provided. The method includes obtaining chip information from a chip that is embedded in a card; receiving a user input that includes the PIN; combining the PIN with the chip information; performing a message authentication code (MAC) operation on the combination in order to generate an application request cryptogram (ARQC); and requesting an authentication of the transaction based on the generated ARQC.