Portable Security Token for Cryptocurrency Wallet Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device authentication systems rely heavily on passwords, which are inconvenient for users due to the need for complexity and length, and are vulnerable to theft and unauthorized access, especially when combined with the risk of device loss or theft, where encryption keys are either complex to manage or insecurely stored.
Innovation Solution
A method and system using a portable security token, such as an NFC or Bluetooth device, that stores a high-strength master key for generating a secure encryption key, requiring user authentication via a PIN or other secret, ensuring that even if the device is stolen, encrypted data remains secure without the token, and credentials can be synchronized across devices and remotely stored for added security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a simple password or PIN is used for authentication, then ease of operation is improved, but security is worsened
Solution Approach 1:
The authentication system is segmented into two independent factors: something the user has (portable security token) and something the user knows (secret/PIN). This segmentation allows each factor to be optimized independently - the token provides strong cryptographic security while the secret remains simple for user input, resolving the contradiction between ease of operation and security.
Solution Approach 2:
A portable security token acts as an intermediary device that generates cryptographic key pairs and manages encryption keys. The token mediates between the user's simple secret and the system's security requirements by using the secret to unlock protective measures that enable strong cryptographic operations, thus bridging the gap between user convenience and security needs.
2Reliability
If a long and complex password is used, then security is improved, but ease of operation is worsened
Solution Approach 1:
The complex cryptographic key management and encryption operations are extracted from the user's direct control and placed into the portable security token. The user only needs to input a simple secret, while the token handles all complex security operations including generating strong encryption keys, managing cryptographic protocols, and performing secure computations, thus extracting complexity from the user interaction layer.
Solution Approach 2:
The portable security token provides self-service cryptographic functions by automatically generating key pairs, managing encryption keys, and performing secure operations without requiring user intervention for complex tasks. The token serves itself to manage its own security credentials while being controlled by the user's simple secret, eliminating the need for users to handle complex passwords or cryptographic operations.
3Reliability
If device encryption is enabled with a complex password, then security is improved, but ease of operation is worsened
Solution Approach 1:
Strong encryption keys are generated and protective measures are set up in advance during device initialization, before the user needs to access data. The portable security token is pre-configured with cryptographic credentials and encryption schemes, so that when the user later provides a simple secret, the pre-established security infrastructure automatically activates without requiring the user to understand or manage the complexity of the encryption system.
4Ease of operation
If the encryption key is stored within the app in plaintext, then ease of operation is improved, but security is worsened
Solution Approach 1:
The portable security token serves as an intermediary that holds and manages the encryption key in a secure environment. Instead of storing the key in plaintext within the app, the system uses the token as a secure vault - the app communicates with the token to retrieve cryptographic operations, and the key never exists in plaintext form in the app's memory or storage, thus eliminating the security vulnerability while maintaining functional accessibility.
Data Source
AI summary
A method and system of conducting a cryptocurrency payment via a mobile device, using a contactless token to store and protect a user's secret key. A cryptocurrency wallet encrypted with the secret key is received by the mobile device from the token. A cryptocurrency payment instruction is received by the mobile device, prompting for a user credential to approve the instruction. In response the mobile device sends to the token a message comprising the encrypted wallet together with the payment instruction and the user credential. Using the secret key, the token then decrypts the cryptocurrency wallet from the encrypted wallet and creates a payment transaction by digitally signing the payment instruction, and transmitting the payment transaction to a cryptocurrency network or exchange. Confirmation of the transaction requires either a PIN, biometric or fingerprint on the mobile device, or authentication via button press, PIN or fingerprint on the token.