Pre-generation of session keys for electronic transactions and devices that pre-generate session keys for electronic transactions

Patent metadata

Field	Value
Publication number	US-10460314-B2
Application number	US-201313938987-A
Country	US
Kind code	B2
Filing date	Jul 10, 2013
Priority date	Jul 10, 2013
Publication date	Oct 29, 2019
Grant date	Oct 29, 2019

Abstract

Methods and devices for pre-generating session keys for securing transactions are provided. A plurality of session cryptographic keys are generated from a master cryptographic key and a respective plurality of possible values of a transaction counter. The session cryptographic keys are encrypted to provide a plurality of encrypted session cryptographic keys, which are stored in the user terminal. The master cryptographic key is deleted from the user terminal after the session keys are generated. To secure a transaction, a cryptogram is generated based on one of the encrypted session cryptographic keys and transaction data for the transaction, and the cryptogram is transmitted to a transaction terminal. The transaction counter is updated, and the encrypted session cryptographic key is deleted from the user terminal.

First claim

What is claimed is:

1. A method of securing a transaction between a user terminal and a transaction terminal, comprising:
generating, using a processing circuit of the user terminal, a plurality of session cryptographic keys from a master cryptographic key on the user terminal and based on a plurality of possible values of a transaction counter;
securing the plurality of session cryptographic keys, wherein said securing comprises:
deleting the master cryptographic key from the user terminal after generating the plurality of session cryptographic keys to prevent regeneration of the plurality of session cryptographic keys; and
encrypting, using the processing circuit of the user terminal, the plurality of session cryptographic keys to provide a plurality of encrypted session cryptographic keys;

storing the plurality of encrypted session cryptographic keys and one of the plurality of possible values of the transaction counter in the user terminal;
generating, using the processing circuit of the user terminal after deleting the master cryptographic key from the user terminal, a cryptogram that is based on a first one of the plurality of encrypted session cryptographic keys and based on transaction data for the transaction;
transmitting the cryptogram to the transaction terminal over a computer network between the transaction terminal and the user terminal;
updating the transaction counter; and
deleting the first one of the plurality of encrypted session cryptographic keys from the user terminal after generating the cryptogram.

2. The method of claim 1 , wherein encrypting the plurality of session cryptographic keys comprises encrypting with a personal identification number.

3. The method of claim 2 , wherein encrypting the plurality of session cryptographic keys comprises camouflaging the plurality of session cryptographic keys.

4. The method of claim 3 , wherein camouflaging the plurality of session cryptographic keys comprises encrypting the plurality of session cryptographic keys in such a manner that decrypting any of the plurality of session cryptographic keys with an incorrect personal identification number produces a valid session cryptographic key.

5. The method of claim 4 , wherein following deletion of the master cryptographic key from the user terminal, there is no data remaining on the user terminal that can be used to decrypt the remaining session cryptographic keys using the transaction data and the cryptogram without attempting a transaction with the transaction terminal.

6. The method of claim 1 , wherein transmitting the cryptogram comprises transmitting the cryptogram to the transaction terminal using a near field communication link, a Bluetooth communication link, a Wi-Fi communication link, or other wireless communication link.

7. The method of claim 1 , wherein the number of session cryptographic keys generated comprises a number of all possible values of the transaction counter.

8. The method of claim 1 , wherein the number of session cryptographic keys generated comprises less than a number of all possible values of the transaction counter.

9. The method of claim 1 , wherein the master cryptographic key comprises a plurality of cryptographic keys.

10. The method of claim 1 , wherein generating the cryptogram comprises applying a hash function to the transaction data and the first one of the encrypted session cryptographic keys.

11. The method of claim 1 , wherein updating the transaction counter comprises incrementing the transaction counter.

12. A computer program product for securing a transaction between a user terminal and a transaction terminal, comprising:
a non-transitory computer readable storage medium having computer readable program code embodied in the medium, the computer readable program code comprising:
computer readable program code to generate a plurality of session cryptographic keys from a master cryptographic key on the user terminal and based on a plurality of possible values of a transaction counter;
computer readable program code to secure the plurality of session cryptographic keys, wherein said securing comprises deleting the master cryptographic key from the user terminal after generating the plurality of session cryptographic keys to prevent regeneration of the plurality of session cryptographic keys;
computer readable program code to store the session cryptographic keys and one of the plurality of transaction counters in the user terminal;
computer readable program code to generate a cryptogram in response to deleting the master cryptographic key based on a first one of the plurality of session cryptographic keys and based on transaction data for the transaction;
computer readable program code to transmit the cryptogram to the transaction terminal;
computer readable program code to update the transaction counter; and
computer readable program code to delete the first one of the plurality of session cryptographic keys from the user terminal after generating the cryptogram.

13. The method of claim 1 , wherein generating the plurality of session cryptographic keys from the master cryptographic key on the user terminal and the plurality of possible values of the transaction counter comprises generating the plurality of session cryptographic keys for all possible values of the transaction counter.

14. The method of claim 12 , wherein the computer readable program code to generate the plurality of session cryptographic keys from the master cryptographic key on the user terminal and the plurality of possible values of a transaction counter generates the plurality of session cryptographic keys for all possible values of the transaction counter.

Assignees

• Ca Inc

Inventors

• Hird Geoffrey R
• Hoover Douglas N

Classifications

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• G06Q20/3829 Primary

  involving key management · CPC title