Ticketless Authorization for Self-Service Terminals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for maintaining self-service terminals lack a secure authorization mechanism to manage user access rights without the need for ticketing systems, making them vulnerable to unauthorized access.
Innovation Solution
A ticketless challenge-response authorization method using a one-time code, identifier, and access right data, where a service terminal system and helpdesk system communicate securely via public channels, utilizing a common secret base key and hash functions to derive and verify session keys for authentication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a ticketing system is used to manage maintenance access, then access control is provided, but system complexity increases and user-friendly access is reduced
Solution Approach 1:
The patent extracts the essential authorization functionality from the complex ticketing system, implementing only the necessary challenge-response mechanism. This removes unnecessary ticketing infrastructure while retaining core access control capabilities, thereby reducing system complexity while maintaining ease of operation
Solution Approach 2:
The terminal system autonomously generates challenges and validates responses without requiring manual ticket creation or intervention. The system performs self-authorization by comparing the received response against locally generated reference responses, eliminating the need for complex external ticketing systems while enabling straightforward user access
2Reliability
If traditional password or hardware key authentication is used, then access control is provided, but security vulnerabilities and fraud risks increase
Solution Approach 1:
The patent implements dynamic authentication where the challenge changes with each authorization request. Instead of static passwords or hardware keys, the system generates unique challenges that must be responded to in real-time, making unauthorized access significantly more difficult while maintaining reliable authorization
Solution Approach 2:
The patent introduces a cryptographic response as an intermediary between the user and the authorization decision. The response acts as a secure mediator that proves authentication without exposing sensitive credentials, thereby enhancing security while reducing fraud risks compared to direct password or hardware key usage
3Ease of operation
If communication occurs over public channels, then ease of operation is improved, but security is compromised without proper encryption
Solution Approach 1:
The patent transforms the communication security model by changing the nature of the data being transmitted. Instead of sending sensitive credentials over public channels, the system exchanges cryptographic challenges and responses that are designed to be secure even in public transmission, thereby maintaining both ease of operation and communication security
Data Source
AI summary
A method of performing an authorization mechanism between a service terminal system (ATM) and a helpdesk system (HD) includes the steps of: sending a request message (RQ) comprising a one-time code (CL), an identifier (CN) for the ATM and a set of access right data (TD) about rights for using the (ATM) by a user (TN); creating a response message (RS) by using the CL, TD, and an ident key (TK) derived from an operation on the CN and a base key (BK), the BK being a common secret of both, the HD and the ATM; sending the RS; creating a reference response message (RS*) by using the CL, the TD, and the TK; and comparing the RS with the RS* to authorize the TN to use the ATM according to the rights being represented by the TD.