Read-Only Card Authentication With Dynamic Polymorphic Tags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods, particularly those relying on EMV protocol, are insecure due to the lack of two-way communication support in many devices and operating systems, making them vulnerable to unauthorized access and duplication.
Innovation Solution
Implementing a transaction card with a dynamic polymorphic tag that changes each time it is read, using a mobile device for authentication, which includes a clock generator to increment a counter and append a unique temporary identifier to a permanent identifier, ensuring secure multi-factor authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EMV protocol with two-way communication is used for authentication, then security is improved, but device compatibility deteriorates because many devices and operating systems do not support two-way communication
Solution Approach 1:
Instead of requiring the card to actively communicate with the terminal (two-way communication), the patent inverts the approach by making the card read-only. The terminal sends a challenge, and the card responds with a signature generated from its private key stored in read-only memory, eliminating the need for two-way communication while maintaining security.
Solution Approach 2:
The patent extracts the essential security function (digital signing) from the complex two-way EMV protocol. By removing the communication overhead and keeping only the critical authentication mechanism, the system achieves security without requiring full two-way communication support.
2Ease of operation
If static identifiers are used on transaction cards, then ease of operation is improved, but security deteriorates due to vulnerability to duplication and unauthorized access
Solution Approach 1:
The patent applies dynamics by making the card identifier dynamic rather than static. Each transaction uses a unique temporary identifier generated by combining a permanent identifier with a counter value that increments with each use. This dynamic approach prevents duplication while maintaining operational simplicity for users.
Solution Approach 2:
The patent changes the parameter of the identifier from static to dynamic by introducing a time-varying counter component. The identifier evolves over time through counter incrementation, transforming it from a fixed value vulnerable to copying into a changing value that provides security against duplication.
3Reliability
If dynamic polymorphic tags are implemented to enhance security, then security is improved, but device complexity increases due to the need for clock generators and counter management
Solution Approach 1:
The patent implements self-service by having the card automatically increment its internal counter and generate new temporary identifiers without external intervention. The clock generator and counter management are handled autonomously by the card itself, reducing the burden on the terminal and minimizing overall system complexity while maintaining security.
Data Source
AI summary
A system for authenticating a user with a mobile device comprising a memory storing instructions, and a processor in communication with a network. The processor may be configured to execute the stored instructions to receive, from a mobile device, an authentication request; obtain, from a database, a permanent identifier associated with a transaction card; generate a temporary identifier associated with the transaction card; generate an expected value by encrypting the permanent identifier and the temporary identifier; verify the expected value against an encrypted value received from the mobile device; and transmit an authorization command to the mobile device.