Unpredictable Number Generation via One-Way Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic authentication systems for payment transactions are vulnerable to fraud due to predictable random number generation, which can be exploited through attacks like frequency injection on ring-oscillator-based True Random Number Generators (RNGs, limiting the range of possible numbers and making transactions susceptible to simulation or modification.
Innovation Solution
A method involving a computing device that generates unpredictable numbers by performing one-way functions on internal and external data elements, including a clock and random numbers, to produce cryptographically secure outputs resistant to subversion and attacks, ensuring the security of payment transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ring-oscillator-based True Random Number Generators are used, then random number generation is provided, but the system becomes vulnerable to frequency injection attacks that limit the range of possible numbers
Solution Approach 1:
The patent introduces a mediator component that collects multiple entropy sources (timing variations, electromagnetic interference, clock jitter) and processes them through cryptographic hash functions. This intermediary layer transforms the potentially vulnerable hardware RNG output into secure random numbers by mixing it with additional entropy sources, thereby neutralizing the frequency injection vulnerability while maintaining random number generation capability
Solution Approach 2:
The patent combines multiple entropy sources (hardware RNG, timing variations, electromagnetic interference, clock jitter) into a composite random number generation system. By mixing these diverse sources through cryptographic processing, the system creates a more secure random number generator that is resistant to attacks on any single source, including frequency injection attacks on ring oscillators
2Ease of manufacture
If deterministic algorithms are used for number generation, then the system is easier to implement, but payment transactions become susceptible to fraud, simulation, cloning or modification
Solution Approach 1:
The system uses self-service by automatically collecting entropy from inherent system variations (timing, electromagnetic interference, clock jitter) without requiring external intervention. These naturally occurring variations are processed through cryptographic functions to generate secure random numbers, providing both ease of implementation and security against fraud
Solution Approach 2:
The patent changes the parameters of random number generation by using variable entropy sources that change with each transaction (timing variations, electromagnetic interference patterns, clock jitter). This ensures that the random number generation is non-deterministic and secure against fraud, while the underlying cryptographic processing maintains ease of implementation
3Reliability
If cryptographic hash functions are applied to multiple entropy sources, then unpredictable numbers are generated, but the computational complexity increases
Solution Approach 1:
The patent applies partial action by selectively processing entropy sources through cryptographic hash functions only when needed for high-security operations. Not all entropy sources are processed with full cryptographic rigor in every case, allowing the system to balance unpredictability with computational complexity based on the specific transaction requirements
Data Source
AI summary
A method of generating an unpredictable number in a computing device is provided. The method comprises the computing device performing the following programmed steps: obtaining a plurality of data elements; performing a first one way function on an internal value P and the plurality of data elements to update the value P; and performing a second one way function on the value P to obtain the unpredictable number. A computing device adapted to perform this method is also described.