Public Key Cryptography Authentication for Transaction Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods, such as password-based systems, are insecure and user-unfriendly, particularly in transactions requiring strong security like electronic payments, as they are prone to errors and susceptible to information theft.
Innovation Solution
A computer-implemented method and system using private-public key pairs for generating and encrypting random numbers, which are then verified and exchanged between devices to authenticate transactions securely without the need for passwords, enhancing security against attacks like man-in-the-middle and replay attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional password-based authentication is used, then the authentication process is simple to implement, but security is compromised due to susceptibility to information theft and replay attacks
Solution Approach 1:
The patent replaces the mechanical password-based authentication system with a cryptographic system using public-private key pairs. The first device generates a random number, encrypts it with the server's public key, and the server decrypts it with its private key to generate a transaction-specific random number. This cryptographic substitution eliminates password vulnerabilities while maintaining system feasibility through standardized cryptographic protocols.
Solution Approach 2:
The patent changes the authentication parameters from static passwords to dynamic random numbers that are transaction-specific. Each authentication involves generating fresh random numbers encrypted with public keys, ensuring that credentials change with every transaction. This parameter transformation prevents replay attacks while the encryption/decryption mechanism manages the increased complexity.
2Reliability
If static passwords are used for authentication, then user operation is simple, but the system becomes error-prone and susceptible to information theft over time
Solution Approach 1:
The first device autonomously generates random numbers and performs encryption using its stored private key without requiring user input of passwords. The user simply initiates a transaction, and the cryptographic authentication proceeds automatically. This self-service approach eliminates password entry errors while maintaining ease of operation through automated cryptographic processes.
Solution Approach 2:
The system performs preliminary cryptographic setup by storing public-private key pairs in advance. During transaction authentication, these pre-established keys enable automatic encryption and decryption without requiring users to remember or input passwords at the moment of authentication. This preliminary cryptographic preparation ensures both security and operational convenience.
3Reliability
If public key cryptography is implemented for authentication, then security against man-in-the-middle and replay attacks is enhanced, but the authentication process becomes more complex
Solution Approach 1:
The server acts as an intermediary that facilitates the cryptographic exchange between the first device and the second device. The server receives the encrypted random number from the first device, decrypts it with its private key, generates a transaction-specific random number, and sends it back encrypted with the first device's public key. This intermediary role simplifies the overall process by centralizing cryptographic operations rather than requiring direct complex key exchange between end devices.
Data Source
AI summary
There is provided a method of performing authentication for a transaction between first and second devices. The method includes: generating a first random number and encrypting it based on a first key of a first private-public key pair; sending the encrypted first random number to the server; receiving a transaction identifier for the transaction, the first random number and a second random number, wherein the transaction identifier, the first random number and the second random number are encrypted based on a first key of a second private-public key pair; decrypting the encrypted transaction identifier, the encrypted first random number and the encrypted second random number based on a second key of the second private-public key pair; and sending the transaction identifier, and the second random number to the second device for authenticating the first device for the transaction. There is also provided a corresponding device and system.