Secure Transaction Authentication via Hardware Security Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticating and securing electronic transactions, particularly those using mobile devices, are vulnerable to spoofing and fail to ensure the authenticity of information transmitted between devices and servers, due to lack of secure asymmetric encryption and transmission of private passwords.
Innovation Solution
A system and method that employs Hardware Security Module (HSM) to encrypt and decrypt public, private, and authentication passwords, using temporary, symmetric, and asymmetric passwords for secure transactions, ensuring authenticity through a multi-layered encryption process and user-specific parameters, and includes a mobile device application for reactivating blocked accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mobile devices are used as authentication tokens with WPKI infrastructure, then authentication capability is provided, but the device can be tricked to generate passwords by false authentication requests
Solution Approach 1:
The system performs preliminary actions by pre-distributing cryptographic key pairs (public and private keys) to authentication devices before they are needed for actual authentication. The private key is securely stored in the device's secure element, and the public key is registered with the authentication server in advance. This preliminary setup ensures that when authentication is needed, the device can immediately prove its identity without being vulnerable to spoofing, as the private key never leaves the secure device.
Solution Approach 2:
The patent introduces an intermediary authentication server that acts as a trusted mediator between the user's mobile device and the service provider. The server verifies the digital signature generated by the device using the pre-registered public key before granting access. This intermediary layer prevents spoofing attacks because even if an attacker intercepts communication, they cannot forge a valid signature without the private key stored in the secure device.
2Reliability
If asymmetric cryptography is implemented with public and private passwords, then security is improved, but the method does not detail how private passwords are securely transmitted and stored
Solution Approach 1:
The patent extracts the sensitive private key management functionality from the general authentication process and places it within a dedicated secure element or hardware security module in the mobile device. The private key is generated and stored exclusively within this secure container, never leaving it in plaintext form. This extraction resolves the implementation complexity by providing a standardized, secure interface for key management while maintaining high cryptographic security.
Solution Approach 2:
The patent implements a universal authentication framework that can be deployed across multiple service providers and devices using standardized protocols (such as FIDO, OAuth, or custom implementations). The same cryptographic infrastructure serves multiple authentication scenarios, reducing implementation complexity through reuse of established patterns while maintaining security through consistent application of asymmetric cryptography across the ecosystem.
3Ease of operation
If information is transmitted between mobile device and server, then authentication is enabled, but the information may not be genuine and authenticity cannot be validated
Solution Approach 1:
The system applies preliminary anti-action by having the authentication server pre-register the device's public key and store it in a protected database before any authentication transactions occur. When the device later transmits information, the server can immediately verify its authenticity using the pre-stored public key. This preliminary preparation prevents authentication failures and ensures information authenticity without adding complexity to the actual authentication flow.
Data Source
AI summary
A system to sign and authenticate secure transactions with an institution through a communications network, comprising a terminal connected to a communications network; a remote server with a database that stores for each user the user data userID, a private password encrypted K′priv, userID, a first security password K′mac, userID to generate an authentication password Kmac, userID and an identifier of the mobile device, Id′cel,userID; a mobile communication device of a user comprising a security code pin; an application, a transport password Ktransporte; a public password encrypted K″pub, userID and a second security password K″mac, userID for generating said authentication password Kmac, userID; and a remote hardware security module. A method to sign and authenticate secure transactions with an institution through a communications network with said system.