Transaction Verification via Segmented Secure Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In electronic commerce, especially in M-commerce, there is a lack of effective verification methods to ensure the legitimacy of transactions, as existing solutions like password-based login and device recognition are vulnerable to hijacking and fraud, given the absence of direct human interaction between merchants and consumers.
Innovation Solution
A method that interrupts electronic transactions to display a transaction identification string (TID) to the user, allowing them to confirm or deny the transaction, using separate secure communication channels and memory spaces to prevent fraudulent activities, with the TID including merchant information, product details, and a nonce string generated via Diffie-Hellman exchange, ensuring secure verification in a protected memory space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device recognition is used to verify transactions in M-commerce, then transaction convenience is improved, but security is worsened due to vulnerability to hijacking
Solution Approach 1:
The patent segments the verification process into two independent parts: device recognition (handled by the operating system) and transaction verification (handled by a separate verification application). This segmentation allows the convenience of device recognition to be maintained while adding a separate security layer that is not vulnerable to the same hijacking attacks. The verification application runs independently and uses a separate communication channel to contact the merchant, preventing attackers from intercepting both device identification and transaction authorization.
Solution Approach 2:
The patent introduces a verification application as an intermediary between the device recognition system and the transaction processing system. This intermediary receives the device identification, independently verifies the transaction details with the merchant through a separate communication channel, and then authorizes or blocks the transaction. This intermediary layer prevents direct hijacking of the transaction process while maintaining the convenience of automatic device recognition.
2Reliability
If password-based login is used for verification, then security is improved, but ease of operation is worsened and transactions can still be compromised
Solution Approach 1:
The patent implements self-service verification where the system automatically performs device recognition and transaction verification without requiring the user to manually enter passwords or credentials. The verification application automatically contacts the merchant, receives transaction details, and presents them to the user for approval. This eliminates the need for password entry while maintaining security through automatic verification processes.
3Adaptability or versatility
If multi-mode communication channels are used in mobile devices, then adaptability is improved, but security is worsened due to potential hijacking of communication interfaces
Solution Approach 1:
The patent segments the communication channels used by different applications. The verification application uses a dedicated, separate communication channel to contact the merchant, distinct from the channels used by other applications like web browsers. This segmentation ensures that even if other communication channels are hijacked, the verification channel remains secure and cannot be intercepted or manipulated by attackers.
Data Source
AI summary
The present invention provides methods and apparatuses for verifying that a transaction is legitimate. The methods and apparatuses use protected memory space, such as kernel space of an operating system, or a separate memory space, such as is available on a SIM card of a cellular phone. The method of the invention proceeds by creating a transaction identification string (TID) and associating the TID with a transaction. The TID contains data relevant to or associated with the transaction and is typically readable by an end-user. The transaction is then interrupted until a user responds in the affirmative to allow completion of the transaction. Methods and devices used in the invention are particularly well suited to M-commerce, where transactions originating from a device are typically recognized by a merchant as coming from the owner of the device without further authentication.