Single-Tap Contactless Authentication Using a Pre-Stored Secret
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for user device interactions, such as double tap interactions, are inefficient and cumbersome when high-value interactions require offline PIN authentication, leading to the need for contact-based interactions instead of contactless ones.
Innovation Solution
A method for performing an offline contactless interaction using a secret with a single tap, where the contactless access device receives and verifies a secret, encrypts it, and sends it to the user device for verification, allowing seamless processing upon successful verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If double tap interaction method is used for high-value interactions requiring offline PIN authentication, then security is improved, but interaction speed and efficiency deteriorate
Solution Approach 1:
The secret is transmitted and stored in the access device before the actual interaction occurs. When a high-value interaction requires PIN authentication, the pre-stored secret enables immediate verification without requiring a second tap, thus maintaining security while improving interaction speed
Solution Approach 2:
A secret (encrypted representation of PIN) is introduced as an intermediary element that bridges the user device and access device. The secret is stored in the access device and serves as a mediator that enables fast authentication verification without requiring repeated physical contact between devices
2Reliability
If double tap interaction method is used, then offline PIN verification is achieved, but operational complexity increases
Solution Approach 1:
The secret is pre-transmitted and stored in the access device before the interaction. This preliminary action eliminates the need for the user to perform a second tap operation, reducing operational complexity while maintaining PIN verification capability
Solution Approach 2:
The secret verification process is extracted from the interaction flow and performed independently using pre-stored data. This separation allows the main interaction to proceed with a single tap while the verification occurs in the background using the pre-stored secret
3Reliability
If contact-based interaction is used for high-value transactions, then authentication security is improved, but loss of time increases
Solution Approach 1:
The mechanical contact-based authentication system is replaced with a contactless system using wireless transmission of the secret and cryptographic verification. This substitution maintains the security of offline PIN verification while eliminating the time loss associated with physical contact requirements
Solution Approach 2:
The secret is pre-transmitted and stored before the interaction occurs. This preliminary action enables the authentication process to complete rapidly during the actual interaction, reducing the time loss while maintaining the security benefits of offline PIN verification
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes an access device determining an interaction value associated with an interaction. The access device prompts a user operating a user device for a secret. The access device receives the secret. The access device receives an initial communication then a user device certificate comprising a public key from the user device. The access device then verifies the certificate. The access device concatenates at least the secret and an unpredictable number to form a concatenated value. The access device encrypts the concatenated value with the public key, then transmits the encrypted concatenated value. The user device decrypts the encrypted concatenated value with a private key, verifies the unpredictable number, verifies the secret, determines whether or not the interaction is approved, produces an interaction authorization result, and then provides the interaction authorization result to the contactless access device. The access device receives the interaction authorization result.