Split PAN Payment Verification for EMV Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current credit card payment systems using mobile devices are not secure and do not meet EMV standards, especially when a card with a magnetic strip or without a microchip is used, and there is no secure card reader device available.
Innovation Solution
A method and system that splits the Personal Account Number (PAN) into two parts, where the merchant enters the first part and the cardholder enters the second part on their respective devices, with the payment server concatenating them for a secure transaction, enhancing security by requiring cardholder involvement and proximity, and using a user signature for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If mobile phone is used for credit card payment without secure card reader device, then portability and convenience are improved, but payment security deteriorates
Solution Approach 1:
The PAN is segmented into two separate parts: the first part is entered by the merchant on the merchant device, and the second part is entered by the cardholder on the cardholder device. This segmentation ensures that neither party has access to the complete PAN, thereby maintaining payment security while enabling portable mobile phone-based transactions without requiring secure card reader devices or EMV-approved chips.
2Ease of operation
If complete PAN is entered by merchant on merchant device, then ease of operation is improved, but payment security deteriorates
Solution Approach 1:
The complete PAN is divided into two separate parts that are entered by different parties on different devices. The merchant enters the first part on the merchant device, and the cardholder enters the second part on the cardholder device. This segmentation prevents the merchant from having access to the complete PAN, thereby maintaining payment security while still allowing for straightforward payment entry procedures.
Solution Approach 2:
The payment server acts as an intermediary that receives the first part of the PAN from the merchant device, stores it securely, and then receives the second part from the cardholder device. The payment server concatenates the two parts to form the complete PAN and transmits it to the bank server. This intermediary role ensures that neither the merchant nor the cardholder has access to the complete PAN, thereby maintaining payment security.
3Reliability
If cardholder enters second part of PAN on cardholder device, then payment security is improved, but device complexity increases
Solution Approach 1:
The payment server serves as an intermediary that manages the complexity of the segmented PAN entry process. It receives the first part from the merchant, stores it securely, receives the second part from the cardholder, concatenates them, and transmits the complete PAN to the bank server. This intermediary management simplifies the overall process while maintaining enhanced security through cardholder participation.
Data Source
AI summary
A method of conducting an electronic card payment between a merchant, having a merchant's device, and a cardholder, having a payment card and a cardholder's device. The method include entering payment card information associated with the payment card comprising at least a first part of a personal account number (PAN), and purchase information in the merchant's device, entering a second part of the PAN in the card holder's device and submitting the second part of the PAN to a payment server, transmitting the purchase information and payment card information to the payment server, where the PANs are concatenated to a complete PAN, and transmitting the purchase information and an updated payment card information with the complete PAN to a bank server conducting the card payment.