Transaction Cryptogram Generation Reducing System Complexity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The dual cryptogram system used in cloud-based transaction systems increases processing power and system complexity, leading to longer transaction times and decreased user satisfaction, particularly in NFC-enabled and remote online payments.
Innovation Solution
A method and system for generating transaction credentials that use an encrypted session key and user authentication credential, where a transaction cryptogram is generated and transmitted to a transaction processing entity, with an optional null user authentication credential used if the user is not authenticated, to reduce system complexity and processing power while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dual cryptogram system is used to secure cloud-based transaction credentials, then security is improved, but system complexity and processing power requirements increase, leading to longer transaction times
Solution Approach 1:
The patent segments the authentication process into two distinct phases: device authentication (first cryptogram) and user authentication (second cryptogram). This segmentation allows the system to verify device legitimacy separately from user authorization, reducing overall system complexity by breaking down the complex dual-cryptogram verification into manageable, independent steps that can be processed efficiently
Solution Approach 2:
The patent implements preliminary device authentication through the first cryptogram before proceeding to user authentication. By pre-verifying that the mobile device is legitimate and authorized to access the transaction system, the patent eliminates the need for complex real-time verification of both device and user credentials simultaneously, thereby reducing processing power requirements and transaction time
2Reliability
If a dual cryptogram system is used to secure cloud-based transaction credentials, then security is improved, but processing power requirements increase, leading to longer transaction times
Solution Approach 1:
The patent divides the cryptographic verification into two separate processing stages: first verifying the device cryptogram to confirm mobile device authorization, then verifying the user cryptogram for PIN validation. This segmentation allows the transaction processing system to handle cryptographic operations in discrete, optimized batches rather than simultaneously processing complex dual-cryptogram validations, thereby reducing peak processing power requirements
Solution Approach 2:
The system performs preliminary verification of the first cryptogram (device authentication) before allocating resources for the second cryptogram verification. This preliminary action ensures that only transactions from authenticated devices proceed to user authentication, eliminating wasted processing power on fraudulent attempts and reducing overall computational burden on the transaction processing system
3Loss of information
If dual cryptograms are generated and validated to distinguish between incorrect PIN and unauthenticated device, then useful transaction status information is provided, but transaction processing time increases, decreasing user satisfaction
Solution Approach 1:
The patent segments feedback information into two distinct authentication outcomes: device authentication status (first cryptogram result) and user authorization status (second cryptogram result). This segmentation enables the system to provide specific, actionable feedback to both the mobile device and user—such as clearly distinguishing between 'device not authorized' and 'incorrect PIN'—without requiring lengthy explanation processes, thereby maintaining fast transaction processing while preserving critical status information
Data Source
AI summary
A method for generating transaction credentials for a user in a transaction, comprising: storing in a mobile device, an encrypted session key, and an encrypted user authentication credential; receiving an authorisation request; initiating a user authorisation process wherein in the event that the user is an authenticated user, the method comprises: decrypting the encrypted session key and encrypted user authentication credential; generating a transaction cryptogram in dependence on the user authentication credential and the session key; transmitting the transaction cryptogram and a user authentication status to a transaction processing entity for use in a transaction.