Shared-Terminal Credential Transfer With Public-Key Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Publicly accessible computing devices, such as kiosks or POS devices, are vulnerable to credential harvesting by malicious actors who can observe and later misuse user login information, necessitating secure and automated access token transfer methods.

Innovation Solution

A terminal device generates a public/private key pair, outputs a detectable code, and uses the public key for encrypting access credentials, which are transferred via a session server to the mobile device for decryption by the terminal device, ensuring only authorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual login credential entry is used at publicly accessible terminal devices, then users can authenticate themselves, but malicious actors can harvest login information by observing the user

Engineering Contradiction:

Improveauthentication securityVSAvoidcredential harvesting vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts the login credentials from the terminal device and stores them in the user's mobile device. The terminal device only displays a code that the mobile device scans, never exposing the actual credentials. This extraction eliminates the vulnerability to credential harvesting while maintaining authentication functionality.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The mobile device acts as an intermediary between the user's authentication and the terminal device. Instead of direct credential entry at the terminal, the mobile device stores credentials securely and uses them to authenticate the user at the terminal by scanning a displayed code, preventing direct observation of credentials.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If access tokens are transferred in plaintext for automated login, then login efficiency is improved, but security is compromised due to potential interception

Engineering Contradiction:

Improvelogin efficiencyVSAvoidcredential transfer security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent applies preliminary anti-action by encrypting the access token before it leaves the mobile device using the terminal device's public key. This pre-encryption prevents any potential interception and misuse of credentials during transfer, while still enabling automated login functionality.

Inventive Principle:

Principle #9Preliminary anti-action

3Extent of automation

If the terminal device stores private keys for decryption, then automated login functionality is enabled, but security risks increase from key exposure

Engineering Contradiction:

Improveautomated login capabilityVSAvoidprivate key exposure risk

Core Design Contradiction:

Extent of automationVSObject-affected harmful factors

Solution Approach 1:

The patent applies local quality by generating a unique key pair for each terminal device. The private key is stored locally in the terminal device and never leaves it, while the public key is distributed to session servers. This localized key management enables automated decryption functionality while minimizing exposure risk.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

Instead of sharing or transmitting the private key, the patent uses the public key as a copy that can be freely distributed for encryption purposes. The original private key remains secure in the terminal device, enabling automated login without exposing sensitive credentials.

Inventive Principle:

Principle #26Copying

4Ease of operation

If scannable codes are displayed for extended periods, then user convenience is improved, but replay attacks become possible

Engineering Contradiction:

Improvelogin convenienceVSAvoidreplay attack vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent implements periodic action by automatically refreshing the scannable code displayed on the terminal device at regular intervals. This periodic refresh maintains user convenience by keeping the code available for scanning while preventing replay attacks through code obsolescence.

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS20250337723A1Secure transfer of access credentials

Publication Date: 2025.10.30 TARGET BRANDS INC

AI summary

In some implementations, a system is provided for securely transferring access credentials from a mobile device that is exclusively operated by a single user, to a terminal device that is shared among multiple different users, via a session server. A session is established between the session server and the terminal device over a secure communication channel. The terminal device generates a key pair, transmits the public key to the session server, and stores the private key. The terminal device outputs a detectable code corresponding to the session. In response to detecting the detectable code, the mobile device transmits an access token payload to the session server. The session server transmits, to the terminal device, an encrypted access token that has been encrypted using the public key. The terminal device decrypts the encrypted access token using the stored private key, and provides operator access to the terminal device.