Systems and methods for cryptographic authentication of contactless cards

Patent metadata

Field	Value
Publication number	US-10565587-B1
Application number	US-201916351401-A
Country	US
Kind code	B1
Filing date	Mar 12, 2019
Priority date	Oct 2, 2018
Publication date	Feb 18, 2020
Grant date	Feb 18, 2020

Abstract

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.

First claim

What is claimed is:

1. A data transmission system comprising:
a transmitting device having a processor and memory, the memory of the transmitting device containing a diversified master key, transmission data and a counter value;
an application comprising instructions for execution on a receiving device having a processor and memory, the memory of the receiving device containing the master key;
wherein the transmitting device is configured to:
generate a diversified key using the diversified master key, one or more cryptographic algorithms, and the counter value,
generate a cryptographic result including the counter value using the one or more cryptographic algorithms and the diversified key,
encrypt the transmission data using the one or more cryptographic algorithms and the diversified key to yield encrypted transmission data, and
transmit the cryptographic result and encrypted transmission data to the application; and

wherein the application is configured to:
generate an authentication diversified key based on the master key and a unique identifier;
generate a session key based on the authentication diversified key and the cryptographic result; and
decrypt the encrypted transmission data and validate the received cryptographic result using the one or more cryptographic algorithms and the session key;
wherein the transmitting device comprises a first contactless card and the receiving device comprises a terminal,
wherein the first contactless card is configured to transmit a first account number to the application,
the data transmission system further comprising a second contactless card that is configured to transmit a second account number to the application,

wherein the application is further configured to:
transmit a first communication to a server, the first communication configured to cause the server to process a payment, the first communication including the first account number and the second account number;
receive a payment amount and determine a first instruction based on a first number, the first number indicative of how many contactless cards transmit information to the application,
determine a tap password, wherein the tap password indicates a second number, the second number comprising a number of taps by at least one selected from the group of the first contactless card and the second contactless card to the terminal,
receive a second communication from the server indicating that the payment was processed.

2. The data transmission system of claim 1 , wherein the receiving device comprises at least one selected from the group of a cellphone, a smart device, and a wearable device.

3. The data transmission system of claim 1 , wherein the application is configured to receive the payment amount from at least one selected from the group of the first contactless card and the second contactless card, and the first communication includes the payment amount.

4. The data transmission system of claim 3 , wherein the payment is equal to the payment amount and the payment is debited from an account associated with at least one selected from the group of the first account number and the second account number.

5. The data transmission system of claim 2 , wherein the application comprising instructions for execution on the wearable device is configured to scan a barcode and determine the payment amount based on the scanned barcode.

6. The data transmission system of claim 5 , wherein the first contactless card is configured to transmit the first account number to the application comprising instructions for execution on the wearable device and the application comprising instructions for execution on the wearable device is configured to send the first communication to the server, the communication including the first account number.

7. The data transmission system of claim 6 , wherein the payment is equal to the payment amount and the payment is debited from an account associated with at least one selected from the group of the first account number and the second account number.

8. The data transmission system of claim 1 , wherein the application is configured to receive the payment amount and a second instruction on how to divide up the payment amount between the first contactless card and the second contactless card, and the first communication includes the payment amount and the second instruction.

9. The data transmission system of claim 8 , wherein the payment is equal to the payment amount and the payment is debited from an account associated with the first account number and an account associated with the second account number, the payment being divided up between the account associated with the first account number and an accounted associated with the second account number based on the second instruction.

10. The data transmission system of claim 1 , wherein the tap password indicates a duration of how long at least one selected from the group of the first contactless card and the second contactless card was tapped on the terminal.

11. The data transmission system of claim 1 , wherein the application is configured to transmit the tap password to the server.

12. The data transmission system of claim 11 , wherein the application is configured to receive an authorization from the server indicating that the tap password is correct.

13. The data transmission system of claim 1 , wherein:
the receiving device is a server; and
the cryptographic result and encrypted transmission data are transmitted by the transmitting device to the application via one or more intermediary devices.

14. A method for transmitting data by a contactless card having a processor and a memory, the memory containing a master key, an identification number, and a counter, the method comprising:
generating a card key using the master key and the identification number;
generating a first session key using the card key and a first portion of the counter and a second session key using the card key and a second portion of the counter, wherein the first portion of the counter is different than the second portion of the counter;
generating a cryptographic result including the counter using one or more cryptographic algorithms and the card key;
generating a cryptogram using the first session key, the cryptogram comprising the cryptographic result and the identification number;
encrypting the cryptogram using the second session key;
transmitting the encrypted cryptogram and the cryptographic result;
transmitting a first account number and a second account number to an application comprising instructions for execution on a receiving device, the receiving device comprising a terminal;
transmitting a first communication to a server, the first communication configured to cause the server to process a payment;
receiving a payment amount and determining a first instruction based on a first number, the first number indicative of how many contactless cards transmit information the application;
determining a tap password, wherein the tap password indicates a second number, the second number comprising a number of taps of each of the contactless cards to the terminal; and
receiving a second communication from the server indicating that the payment was processed.

15. The method of claim 14 , wherein the application comprising instructions for execution on the receiving device including at least one selected from the group of a cellphone, a smart device, and a wearable device.

16. The method of claim 14 , wherein the payment is equal to the payment amount and the payment is debited from an account associate

Assignees

• Capital One Services Llc

Inventors

• Newman Kaitlin
• Haynes Kimberly
• Crank Charles Nathan
• Cogswell Andrew
• Hart Colin
• Rule Jeffrey
• Mossler Lara
• Gulati Latika
• Benkreira Abdelkader
• Cunningham Sarah Jane
• Bermudez Sophie
• Mossoba Michael
• Lutz Wayne

Classifications

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/3226 Primary

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L9/0822

  using key encryption key · CPC title

• H04L9/0861

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title