Secure Card Solution With Rotating Keys
Our patent-pending* solution leverages the principles of assumption of breach and zero-trust as core principles of its design while relying on existing commodity technologies already in use in production environments.
*Patent Application US 62/923,025
What Is The Need?
On October 1, 2015, all all point of sale (POS) terminals in the United States were required to begin using EMV IC smart cards. Billions of dollars were spent upgrading POS terminals and issuing new cards to customers. However, IC cards were not a new technology. Put in perspective, if it was a person, it would have been old enough to have earned a college degree in 2015.
Since then, security researchers have demonstrated methods to circumvent the new standard. While smart cards are more difficult to compromise, new vulnerabilities will surely be found. What’s more, the new cards were several times more expensive than other solutions. Why had the United States implemented such dated technology instead of leading the world with the next-generation of payment cards? With such an expensive rollout complete, is there a way to deploy a more secure solution without requiring another costly upgrade?
Our solution provides just that – a highly-secure physical authentication device using inexpensive commodity hardware which is compatible with existing readers (including mobile devices). What’s more, this solution has use-cases beyond payment cards including applications in access control, authentication and authorization, and more.
Authenticity and Integrity
Two core principles of any physical security device are authenticity and integrity. In this context, authenticity refers to the guarantee that the device is unique and has not been cloned or duplicated. Integrity refers to the condition of the device and whether or not it has been tampered with or compromised.
While modern devices implement mechanisms to ensure that they remain secure, they all rely on either authenticity or integrity alone at the expense of the other. This results in a security device that can be modified, corrupted, duplicated, or spoofed by bad-actors. Only our patent-pending solution is able to guarantee both authenticity and integrity of the device itself by upholding the principles of assumption of breach and zero trust.
FALSE: It Is Impossible to Clone Smart Cards
While technology such as smart cards and U2F tokens were once thought to be impossible to clone, security researchers and hackers have discovered new methods to bypass their security again and again . . . and again (in 2019!) While they do largely eliminate the threat of skimming, they are not tamper- or clone-proof. When relying on static devices, it is only a matter of time before they are compromised, and pen testers have always maintained that direct physical access to a device means “game over.” It is impossible to ensure the authenticity of static security keys with complete certainty. Once these devices are inevitably compromised or duplicated, how can it be detected?
PROBLEM: IC Cards Are Expensive and Not Mobile-Friendly
The average cost of an EMV IC smart card is $3-4. Dual-interface cards add at least $1 to the price. New biometric dual-interface cards are likely to be much more expensive, and the delicate fingerprint sensors may be more easily damaged (leading to more frequent replacements). Additionally, none of these solutions are inherently compatible with mobile devices and require small businesses to purchase additional expensive hardware. Our solution can be implemented on lower cost devices such as NFC cards that are mobile-friendly while still providing superior security compared to IC cards.
FALSE: Physical Security Devices Will Soon Be Replaced
Despite the rise of smartphones, biometrics, and behavioral analytics, there will always be a need for physical security devices for high-security applications such as payment processing, access control, authentication, etc. There are two primary reasons why this is true. First, connected devices like smartphones pose an inherent risk of being remotely compromised. Second, physical devices are one of the three factors of authentication – something you have (physical devices), something you know (passwords, etc), and something you are (biometrics). There will always be situations where a physical device is required. However, there is generally no way of ensuring that malicious users have not tampered with or compromised static security devices.
PROBLEM: Short-Range Wireless Poses Security Risk
On their own, short-range wireless technologies such as NFC, RFID, and Bluetooth cannot be secured. There is ALWAYS a way to remotely intercept and read signals from such devices. While security measures can be taken to prevent compromise, relying on contactless technology alone opens the door for numerous attacks from malicious users. As banks and companies consider issuing contactless and dual-interface cards to their users, adding an additional mechanism to ensure their authenticity is a growing necessity.
Our Solution
By way of analogy, our solution is similar to web authentication. When logging into a website, an authentication cookie is created based on a username and password. This piece of data is stored on the user’s computer and used by the browser to determine if a user is logged into the website or not. If this cookie is copied from one device to another, a malicious user can gain access to the website without detection by the user or website.
To solve this issue, many sites add a secondary rotating session cookie. This piece of data is stored on a user’s computer and is regularly checked and updated by the website’s servers as the user accesses their account. When a user logs in with a new device, the website will create and maintain a new session cookie that is unique to that device. This allows the website to manage and detect new devices accessing the account. However, since the session cookie is regularly updated, if it is intercepted or copied to a new device, the session cookie from one device will become invalid as soon as it is used on another device. This provides a mechanism to determine when an account may have been compromised.
Similarly, standard authentication devices such as smart cards, U2F tokens, and NFC cards rely on static data/circuitry much like a simple authentication cookie. If the device is somehow duplicated or data is intercepted, malicious access is impossible to detect. Our patented process employs the use of a rotating key on authentication devices similar to the session cookies used by a website. As a result, duplication and compromises can be easily detected and thwarted.
Possible Implementations
Our process leverages any device with at least two forms of data being stored/presented and at least one of these being writable. This provides nearly limitless combinations of technologies which could be utilized to implement our process on any given device. However, due to the accessibility and ubiquitous presence of certain technologies in existing markets, we suggest the following implementations.
Potential Use Cases
There is no limit to the applications of our secure card. What’s more, many systems currently in use could be adapted to utilize our card as a drop-in solution due to its use of existing technologies. Below are just a handful of examples for how our technology could be leveraged across a variety of markets.
Working Proof of Concept
Our current demonstration and POC platform utilizes a Honeywell Metrologic MS7820 Solaris barcode scanner and a MIFARE NFC card imprinted with a QR barcode. This system is fully-functional and successfully demonstrates the working principle of our solution. Additionally, we are exploring the development of a POC utilizing a dual-interface smart card to demonstrate how our solution can be implemented with a smart card that utilizes both an IC and NFC.
Interested? Let’s Talk!
We’re currently looking for interested parties to partner with us and bring our device to market. Are you the manufacturer of access control systems and hardware? Are you involved in the PCI industry and looking for the next generation of physical payment devices that wouldn’t require deploying new, expensive hardware? We’d love to discuss different application possibilities and how our technology can provide solutions for you and your customers.