Transaction Authentication via Cryptogram Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for transmitting sensitive data payloads for transaction authorization over networks face security challenges due to insecure network links, making them vulnerable to 'man in the middle' attacks and fraud.
Innovation Solution
A computer-implemented method and system for authenticating transactions over a secure network, involving a first authentication server that receives a sensitive data payload and a cryptogram, transmits these to a second authentication server for validation, and then to an issuer server for final authentication, enhancing security without excessive resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional token-based authentication is used over public networks, then the authentication process is simple and fast, but the security is insufficient due to vulnerability to man-in-the-middle attacks
Solution Approach 1:
The system performs preliminary actions by generating cryptograms before data transmission and validating them at the authentication server. The cryptogram is created in advance based on transaction-specific data, ensuring security measures are in place before the actual authentication occurs, thus preventing man-in-the-middle attacks without complicating the user interface
Solution Approach 2:
The authentication server acts as an intermediary that receives both the token and cryptogram, validates the cryptogram independently, and then authenticates the transaction. This intermediary role adds a security layer without requiring changes to the merchant or customer devices, resolving the contradiction between security and complexity
2Reliability
If additional security measures like consumer authentication questions are implemented, then the security of the transaction is improved, but the processing time increases and user experience deteriorates
Solution Approach 1:
The system uses self-service by automatically generating and validating cryptograms without requiring customer intervention. The cryptogram validation happens automatically at the authentication server, eliminating the need for additional customer authentication steps while maintaining high security standards
Solution Approach 2:
Security validation is performed preliminarily through cryptogram verification before the actual transaction approval. This preliminary validation ensures security is established upfront, allowing the transaction to proceed quickly without requiring additional time-consuming authentication questions during the transaction process
3Reliability
If token and dynamic data are sent during authorization, then the authentication entity can perform validation, but the network bandwidth and processing resources are consumed
Solution Approach 1:
The system extracts only the essential validation elements (cryptogram and token) needed for authentication, sending them to the authentication server. By taking out only the necessary components for validation rather than transmitting all possible data, the system maintains authentication capability while reducing network and processing resource consumption
Data Source
AI summary
The present disclosure relates to a computer-implemented method and to a system for authenticating a transaction over a secure network. The method comprises, prior to authorization of a transaction: receiving, by a digital service server, from a merchant plug-in (MPI) computing device, via a directory server, a token and a first cryptogram for the transaction; and then decrypting, by the digital service server, the token into sensitive data; and validating, by the digital service server, the first cryptogram, based on one or more session keys; and then, based on the first cryptogram not being validated: setting a validation flag to a defined value indicating that the first cryptogram is not valid; and sending, to a user device of a user, an authentication request message, as an authentication step-up, to verify the user and the authenticity of the transaction.