Secure Element Gesture Input for Mobile Transaction Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Mobile devices' non-secure environments for processing user inputs during transactions make them vulnerable to malware interception and PIN code theft, compromising user authentication and transaction validation security.

Innovation Solution

Implementing a master secure element with gesture recognition capabilities to control user input on touch screens, ensuring that transaction validation occurs within a secure domain while maintaining non-secure display output, allowing users to validate transactions through digit tracing on the secure touch screen, which is verified by the secure processor.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If PIN code entry is required for transaction validation, then transaction security is improved, but user convenience deteriorates and PIN code theft risk increases

Engineering Contradiction:

Improvetransaction securityVSAvoiduser convenience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent extracts the PIN code entry function from the non-secure host environment and relocates it to the secure element. The secure element now directly controls the display and receives biometric input (fingerprint) within the secure boundary, eliminating the need for users to enter PIN codes in the vulnerable non-secure environment while maintaining strong authentication security.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If PIN code entry is required for transaction validation, then transaction security is improved, but susceptibility to malware interception increases

Engineering Contradiction:

Improvetransaction securityVSAvoidmalware interception risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the authentication system into two distinct parts: a non-secure display area showing transaction details controlled by the host, and a secure input area (fingerprint sensor) controlled exclusively by the secure element. This segmentation ensures that even if malware compromises the host, it cannot intercept or manipulate the biometric authentication process occurring in the isolated secure domain.

Inventive Principle:

Principle #1Segmentation

3Reliability

If frequent PIN code entry is required, then transaction validation security is improved, but probability of PIN code observation and theft increases

Engineering Contradiction:

Improveauthentication securityVSAvoidPIN code observation risk

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent replaces the mechanical keyboard input method (typing PIN codes) with a biometric recognition system (fingerprint scanning). This substitution eliminates the intermediate step of visual PIN entry that is vulnerable to observation and shoulder surfing, while maintaining strong security through unique physiological characteristics. The fingerprint authentication occurs entirely within the secure element's protected environment.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10147090B2Validating a transaction with a secure input without requiring pin code entry

Publication Date: 2018.12.04 NXP BV

AI summary

A method for secure transactions on a mobile handset or tablet equipped with a touch screen controlled by a secure processor such as a master secure element or Trusted Execution Environment having gesture recognition capabilities. Since the touch screen is fully controlled by the secure processor, the user can securely enter the transaction amount using gestures to validate the transaction.