Smart Card Authentication Using Time-Based Dual Virtual Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods using virtual codes are vulnerable to data leaks, require separate OTP generation devices, and have security weaknesses due to seed data exposure, necessitating a secure and efficient method for generating and verifying virtual codes without additional hardware.
Innovation Solution
A smart card device generates a virtual code for authentication by embedding an IC chip, receiving time data via NFC, and generating primary and secondary authentication codes using time data and user/device IDs, which are verified by a server to ensure secure user authentication in both offline and online transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single virtual code is used for authentication, then the authentication process is simple, but the security is insufficient due to hacking and phishing risks
Solution Approach 1:
The patent divides the authentication code into two separate codes: a first virtual code generated by the card using time data and a first OTP, and a second virtual code generated by the device using the first virtual code, time data, and a first UID. This segmentation allows each code to have a specific security function while maintaining a structured authentication process that resists hacking and phishing attacks.
2Ease of operation
If contactless communication is used for convenience, then the ease of operation is improved, but the risk of unauthorized access and information leakage increases
Solution Approach 1:
The patent introduces time data as an intermediary element in the authentication process. The time data is transmitted to the card and used by both the card and the device to generate virtual codes. This intermediary mechanism ensures that even in contactless communication, the authentication remains secure because the codes are time-dependent and cannot be easily intercepted or reused.
3Productivity
If traditional authentication methods are used, then the device complexity is low, but the productivity is reduced due to multiple verification steps
Solution Approach 1:
The patent merges the generation of virtual codes with the authentication verification process. The server receives the second virtual code along with time data and the first UID, and performs verification in a single step. This merging of code generation and verification reduces the number of separate steps required, improving authentication efficiency while maintaining security.
Data Source
Figure 1~3
Figure 4~5
Figure 6
AI summary
A method performed by a device for generating a virtual code for authentication, comprising: transmitting (S110), time data to a card upon tagging of the card in which an IC chip has been embedded; receiving (S120), from the card, a first virtual code generated based on the time data; generating (S130), a second virtual code for authentication by using the first virtual code; transmitting (S 140), the second virtual code to a server; and requesting (S 150), the server to perform verification on the second virtual code; characterized in that: the first virtual code is generated based on the time data and a first OTP, and the second virtual code is generated based on the first virtual code, the time data and a first UID, which is identification information of the card.