SMS Payment Token Validation via HMAC Seed Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transportation payment systems face challenges in reliably accepting SMS payments without continuous network connections, managing time-dependent payments, handling user changes in transportation, and preventing fraud, especially in scenarios where users collude against the system.
Innovation Solution
A system that uses a portable terminal, such as a GSM mobile phone, to generate and validate authentication tokens based on shared secrets and a periodically updated seed, allowing users to purchase transportation services from a remote transaction provider and validate tokens locally even without continuous connectivity, using HMAC for security and time-based token generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SMS-based payment system is used without continuous network connection, then system operability in transportation is improved, but reliability of transaction validation deteriorates
Solution Approach 1:
The system pre-generates and stores multiple authentication tokens locally in the redemption device before the actual transaction occurs. When a user presents an SMS code, the device validates it against pre-stored tokens, enabling offline validation while maintaining security. This preliminary preparation resolves the contradiction by allowing operational flexibility without continuous connectivity while ensuring reliable validation through pre-computed authentication data.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using pre-shared secrets and locally generated tokens that act as a mediator between the user's SMS payment and the local redemption device. This intermediary layer allows validation to occur locally without direct real-time connection to the remote server, maintaining both operability and reliability by decoupling the validation process from continuous network dependency.
2Adaptability or versatility
If authentication tokens are generated remotely and validated locally without continuous connection, then system adaptability to non-continuous environments is improved, but security against fraud deteriorates
Solution Approach 1:
The authentication system is segmented into multiple components: remote token generation, local storage of authentication data, and distributed validation across multiple redemption devices. Each device maintains its own secure copy of authentication tokens and validation logic, creating isolated security zones. This segmentation allows the system to adapt to non-continuous environments while preventing fraud through distributed security verification rather than centralized dependency.
Solution Approach 2:
The system employs periodic synchronization where authentication tokens are generated and updated at regular intervals, and redemption devices periodically refresh their local authentication data. This periodic action ensures that even in non-continuous environments, the system maintains current authentication credentials while allowing operation between synchronization points, balancing adaptability with security through time-bound authentication validity.
3Adaptability or versatility
If multiple authentication tokens are stored locally for time-dependent services, then system versatility for time-based transactions is improved, but device complexity increases
Solution Approach 1:
The system manages complexity by changing parameters of authentication tokens rather than storing entirely separate authentication data for each time period. Tokens are generated with embedded temporal parameters (validity periods, time windows) that automatically expire or become invalid based on time conditions. This parameter-based approach enables versatile time-dependent transactions while keeping device storage and validation logic relatively simple, as the same validation mechanism handles multiple time-based scenarios through parameter differentiation rather than structural complexity.
Data Source
AI summary
A mobile terminal is equipped for SMS payment and service authentication with a remote transaction provider. The remote provider uses common secrets & a seed in a keyed Hash Machine Address Code (HMAC) executing a Message Digest Algorithm to generate a list of authentication token (username-password) for the purchase of services an/or goods. The common secrets and seed are shared with local redemption devices which also generate the list of authentication token. A subscriber conducts payment with the remote transaction provider and receives an authentication token corresponding to the purchased service. The subscriber provides the authentication token to the redemption device which compares the authentication token with sets of valid authentication tokens generated by the redemption terminal. If the comparison indicates a match, the redemption device provides the service to the subscriber.