Signed Receipt Verification for Secure In-App Purchases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In-App purchasing systems face security vulnerabilities due to potential compromises in user device security, which can lead to malicious exploits and data theft, despite the use of secure protocols.
Innovation Solution
A layered security system using unique device and vendor identifiers, cryptographic signatures, and redundant verification methods to secure In-App transactions, including enhanced validation mechanisms and operating system involvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secure protocols are used between In-App store servers and devices, then transaction security is improved, but vulnerabilities may still exist if security elements are disabled or compromised by user action or system malfunction
Solution Approach 1:
The patent segments the security verification process into multiple independent components: device identifier extraction, cryptographic signature verification, and transaction validation. Each component operates independently to provide layered security, so that compromise of one element does not necessarily compromise the entire system.
Solution Approach 2:
The system performs preliminary security actions by pre-establishing cryptographic signatures and device identifiers before transactions occur. The device identifier is extracted and verified in advance, and cryptographic signatures are prepared beforehand to authenticate transactions, preventing unauthorized access before it can occur.
2Reliability
If a layered security system with redundant verification is implemented, then protection against malicious exploits is improved, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary cryptographic signature mechanism that mediates between the device and the In-App store server. This intermediary layer verifies device identifiers and transaction authenticity without requiring direct complex interaction between all system components, simplifying the overall architecture while maintaining security.
Solution Approach 2:
The system creates and verifies cryptographic copies (signatures) of device identifiers and transaction data. These cryptographic copies serve as simplified representations that can be verified without handling the original complex security elements, reducing verification complexity while maintaining security integrity.
3Reliability
If device identifiers are verified through cryptographic signatures, then unauthorized access is prevented, but processing time increases due to multiple verification steps
Solution Approach 1:
Device identifiers are extracted and cryptographic signatures are prepared in advance before the actual transaction occurs. This preliminary preparation allows the verification process to proceed more quickly during the transaction, as the heavy computational work has already been performed.
Solution Approach 2:
The patent replaces complex mechanical or procedural verification methods with cryptographic verification. Cryptographic signature validation is computationally efficient compared to alternative verification methods, enabling fast verification while maintaining strong security guarantees against unauthorized access.
Data Source
AI summary
In one embodiment, a unique (or quasi unique) identifier can be received by an application store, or other on-line store, and the store can create a signed receipt that includes data desired from the unique identifier. This signed receipt is then transmitted to a device that is running the application obtained from the on-line store and the device can verify the receipt by deriving the unique (or quasi-unique) identifier from the signed receipt and comparing the derived identifier with the device identifier stored on the device, or the vendor identifier assigned to the application vendor.