Tag-Based Service Authentication Using Intermediary Certification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing tag-based services lack secure and undeniable user identification, particularly for personalized services involving financial transactions, where ambiguity in user identity can occur, especially when using mobile communication devices for accessing services.
Innovation Solution
A method and system that utilize a mobile communication device to capture tags, generate a service request with a security feature using unique user information, and verify this feature through a certification unit, ensuring the authenticity of the service request by confirming it with a trusted certification server independent of the application server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user information is transmitted from the reader device to the service provider for identification, then the service can be accessed, but the security and undoubtful determination of user identity is insufficient
Solution Approach 1:
A certification server is introduced as an intermediary between the reader device and the application server. The certification server receives the service request, verifies the security feature (digital signature) generated by the reader device, and only then forwards the request to the application server. This mediator ensures reliable user identification without requiring the application server to directly handle complex authentication logic, thus improving security while managing system complexity through modular architecture.
2Reliability
If a security feature is generated and verified through a certification unit, then user authentication security is improved, but the system complexity increases
Solution Approach 1:
The authentication system is segmented into distinct functional components: the reader device generates security features using its own private key, the certification server verifies these features using stored public keys, and the application server processes authenticated requests. This segmentation allows each component to focus on a specific security function, improving overall authentication security while keeping the architecture modular and manageable.
Solution Approach 2:
The certification server acts as a trusted intermediary that handles all verification operations. By centralizing the verification function in a dedicated server that maintains a database of public keys, the system achieves strong authentication security without requiring complex distributed verification logic across multiple servers, thus managing architectural complexity effectively.
3Reliability
If the certification unit is spatially separated from the application server, then authentication independence is improved, but the system complexity increases
Solution Approach 1:
The system is segmented into functionally independent modules: the certification server handles only authentication verification, while the application server handles only service processing. This segmentation ensures that authentication independence is maintained - the application server cannot be compromised to bypass authentication - while the modular design allows each server to be simpler and more easily maintained.
Data Source
Figure 1
AI summary
The invention relates to a method for accessing a personalized tag-based service using a mobile communication device (102), the service being provided by an application server (110), the method comprising the steps of: (i) capturing the tag (101) using a reader unit (103) of the mobile communication device (102) and passing information included in the tag (101) to an application, (ii) the application generating a service request based on the information and adding to the service request a security feature, the security feature being generated using information uniquely assigned to a user of the mobile communication device (102), (iii) transmitting the service request from the mobile communication device (102) to a certification unit (111), and (iv) the certification unit (111) verifying the security feature included in the service request and confirming the authenticity of the service request to the application server (110) in response to a successful verification of the security feature. Furthermore, the invention relates to a system for executing the method.