Server-Based Key Derivation for HCE Mobile Payment Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Host Card Emulation (HCE) based mobile contactless payment solutions are vulnerable to security breaches due to their exposure in the 'rich' mobile operating system, necessitating additional security measures.
Innovation Solution
A method involving a server-derived key for encrypting and decrypting verification values using a PIN-based key derivation function, combined with user authentication through fingerprint verification, to authorize transactions securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If HCE solutions are used for mobile contactless payments, then the solution is more openly exposed and easier to implement, but it becomes vulnerable to security breaches
Solution Approach 1:
The patent introduces a server as an intermediary between the mobile device and the payment network. The server derives keys from the mobile PIN, encrypts verification values, and validates transactions remotely. This mediator architecture allows HCE to maintain its openness and ease of implementation while adding a security layer that protects against breaches by handling sensitive cryptographic operations remotely rather than storing sensitive data locally in the vulnerable mobile OS.
2Reliability
If additional security measures are added to HCE solutions, then security vulnerability is reduced, but device complexity increases
Solution Approach 1:
The patent extracts the complex cryptographic key management and verification logic from the mobile device and relocates it to a remote server. The mobile device only needs to store a simple PIN and perform basic operations, while the server handles key derivation, encryption, and verification. This extraction reduces device complexity while maintaining strong security, as the heavy cryptographic processing is performed remotely where it can be more securely implemented.
3Reliability
If a server-based key derivation and encryption system is implemented, then security of HCE transactions is enhanced, but communication and processing time increases
Solution Approach 1:
The patent performs key derivation and encryption operations in advance during transaction setup, so that when the actual payment is made, the verification is already prepared. The server derives keys from the PIN and encrypts verification values before the transaction occurs, allowing for faster authorization during the actual payment moment. This preliminary action reduces the time loss during the critical transaction phase while maintaining the security benefits of server-based cryptographic operations.
Data Source
Figure 1~2
Figure 3~4
Figure 5~7
AI summary
The invention concerns a method of transaction authorization comprising: deriving, by a first server, a first key based on a mobile PIN value associated with a mobile device; encrypting, by the first server based on the derived key, a verification value to generate an encrypted verification value (eSEALATC); transmitting, by the first server, the encrypted verification value to the mobile device; receiving, by the first server or by a second server, a further verification value (SEALATC') generated by the decryption of encrypted verification value using a second key (KEYPIN') derived based on a candidate PIN value entered into the mobile device or based on a PIN stored by the mobile device and released after a user authentication operation; and authorizing the transaction based on a verification of the further verification value.