Read-Only Card Authentication Using Dynamic Polymorphic Tags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, particularly those relying on EMV protocol, are insecure due to the lack of two-way communication support in many devices and operating systems, making them vulnerable to unauthorized access and duplication.
Innovation Solution
Implementing a transaction card with a dynamic polymorphic tag that changes each time it is read, using a mobile device for authentication, which includes a clock generator to increment a counter and generate a unique temporary identifier for each read, enhancing security by preventing duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EMV protocol with two-way communication is used for authentication, then security is improved, but device compatibility deteriorates because many devices and operating systems do not support two-way communication
Solution Approach 1:
Instead of requiring the card to actively communicate with the terminal (two-way communication), the invention inverts the approach by making the card read-only. The authentication security is maintained through cryptographic verification of the card's static data, while compatibility is improved by eliminating the need for two-way communication support in the terminal device.
2Adaptability or versatility
If static authentication data is stored on the card, then device compatibility is improved, but security deteriorates because the data can be copied and reused by unauthorized users
Solution Approach 1:
The invention acknowledges that static data on the card can be copied, but prevents the harmful effect of copying by using cryptographic verification. The terminal verifies the authenticity of the card data through cryptographic algorithms, so even if the data is copied, the copy cannot be verified as authentic without the original card's cryptographic proof.
Data Source
AI summary
A system for authenticating a user with a mobile device comprising a memory storing instructions, and a processor in communication with a network. The processor may be configured to execute the stored instructions to receive, from a mobile device, an authentication request; obtain, from a database, a permanent identifier associated with a transaction card; generate a temporary identifier associated with the transaction card; generate an expected value by encrypting the permanent identifier and the temporary identifier; verify the expected value against an encrypted value received from the mobile device; and transmit an authorization command to the mobile device.