Token Server Mediates EMV Card Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current two-factor authentication methods, such as FIDO-U2F, are limited in their ability to utilize existing user devices like credit cards or mobile phones without requiring special authenticators or significant computational resources, and often necessitate additional PIN inputs, making them inconvenient for widespread adoption on non-PC devices.
Innovation Solution
A method that employs an EMV card as a second factor using a token server connected to a client device, which handles resource-intensive tasks and authenticates the card without needing special cryptographic capabilities or PIN verification, allowing any data carrier to be used without issuer approval and maintaining compatibility with standardized FIDO methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If FIDO-U2F standard is used for two-factor authentication, then security is improved, but device compatibility and ease of operation deteriorate because special USB dongles or NFC authenticators are required that users must acquire specifically for FIDO applications
Solution Approach 1:
The patent enables existing multi-functional devices (mobile phones, tablets, PCs with browsers) to perform U2F authentication functions. The system makes the second factor universally accessible through devices users already possess, eliminating the need for specialized FIDO-only hardware while maintaining security standards
Solution Approach 2:
The patent introduces a server component that acts as an intermediary between the relying party and the client device. This server facilitates the authentication process by generating challenges and verifying responses, enabling U2F functionality through existing devices without requiring direct implementation of complex cryptographic operations on the client side
2Adaptability or versatility
If RSA signing is used for authentication on credit cards, then compatibility with existing cards is improved, but execution time deteriorates because RSA key generation and signing absorb too much computing time on the card
Solution Approach 1:
The patent divides the authentication process into separate stages: key generation occurs during card provisioning (not during authentication), and the authentication phase only requires lightweight verification operations. This segmentation allows RSA to be used on existing cards without timing issues during the actual authentication moment
Solution Approach 2:
The patent performs computationally intensive operations (RSA key generation) in advance during card issuance, storing the public key on the server. During authentication, only lightweight verification is needed, eliminating timing problems while maintaining RSA compatibility with existing cards
3Adaptability or versatility
If eID functionality is enabled on national identity cards for two-factor authentication, then device versatility is improved, but ease of operation deteriorates because additional six-digit password input is required while holding the card to the NFC interface
Solution Approach 1:
The patent extracts the password verification step from the NFC authentication flow. Instead of requiring password input during the card-to-NFC process, the system uses the card's cryptographic credentials directly for authentication, eliminating the additional password input requirement while maintaining security
Data Source
AI summary
The invention relates to a method for carrying out a two-factor authentication between a client and a relying party, wherein, as the second factor, a data carrier is employed which carries out a communication with a token server.