Transaction Security via Data Alteration and Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The security of transaction processes using software smart card emulation in communication devices is compromised due to the lack of a secure element, making them vulnerable to unauthorized access and data theft, despite attempts to prevent software hacking.
Innovation Solution
A method is introduced to detect unauthorized use of the software transaction application by inserting detection points and altering sensitive data, which is then restored and used to compute a cryptogram, allowing the server to reject unauthorized transactions and notify the user of potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software smart card emulation is used without a secure element, then ease of operation and device compatibility are improved, but security and protection against unauthorized access deteriorate
Solution Approach 1:
The patent implements detection points that are activated before sensitive operations occur. These detection points check for unauthorized modifications, debugging, or hacking attempts in advance, and alter sensitive data accordingly to prevent successful attacks while maintaining normal operation for legitimate users.
Solution Approach 2:
The patent introduces an intermediary mechanism that sits between the software transaction application and the sensitive data. This intermediary actively monitors and modifies data based on detected threats, serving as a protective layer without requiring hardware secure elements.
2Reliability
If detection points are inserted into the software transaction application, then security monitoring capability is improved, but device complexity and difficulty of maintenance increase
Solution Approach 1:
The patent designs detection points with a universal structure that can identify multiple types of threats (debugging, hacking, unauthorized access) using a common framework. This multi-functional approach reduces overall system complexity compared to implementing separate detection mechanisms for each threat type.
Solution Approach 2:
The patent uses parameter changes (altering sensitive data) as a response to detected threats. By modifying data parameters rather than implementing complex countermeasures, the system maintains simplicity while effectively responding to security incidents.
3Reliability
If sensitive data is altered based on detection results, then security protection effectiveness is improved, but transaction processing time and system performance deteriorate
Solution Approach 1:
The patent implements detection points that can quickly skip or rush through the data alteration process when threats are detected. The system efficiently modifies sensitive data without extensive processing delays, allowing security responses to occur rapidly within the transaction flow.
Solution Approach 2:
The detection points and data alteration mechanism operate autonomously within the software transaction application. The system self-monitors and self-corrects by altering its own data when threats are detected, eliminating the need for external intervention and reducing processing overhead.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
This invention concerns a method and system for improving the security of transaction in an emulated Integrated Circuit (ICC). During compilation time of a payment application, at least one detection agent are inserted into the code of the payment application. This detection agent is configured to detect an unauthorized use of the payment application. During a runtime of the payment application, if the detection agent result indicates "no threat detected" the payment application retrieves from a predefined map of "no threat detected", the right value associated to the detection agent, otherwise a random false value is generated. The payment application alters at least one data manipulated during the transaction with the value retrieved or generated. A reverse mechanism of the payment application retrieve the right value and apply a restoration process to the altered data with the retrieved right value. The payment application computes a cryptogram from the restored manipulated data. From the computed cryptogram, a third party can authorize or reject the transaction.