Offline authentication

Patent metadata

Field	Value
Publication number	US-10846694-B2
Application number	US-201514719014-A
Country	US
Kind code	B2
Filing date	May 21, 2015
Priority date	May 21, 2014
Publication date	Nov 24, 2020
Grant date	Nov 24, 2020

Abstract

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include using a limited-use key (LUK) to generate a transaction cryptogram, and using a signature key to generate a signature. The transaction can be an offline data authentication transaction, and access can be granted based on authentication of the signature prior to verifying the transaction cryptogram.

First claim

What is claimed is:

1. A method for enhancing security of a communication device when conducting a transaction offline using the communication device, the method comprising:
receiving, from a remote computer by an application installed on the communication device, a limited-use key (LUK) that is associated with a first set of one or more limited-use thresholds that limits usage of the LUK, and a signature key that is associated with a second set of one or more limited-use thresholds that limits usage of the signature key, wherein the first set of one or more limited-use thresholds includes a first limited-use threshold that is different than a second limited-use threshold included in the second set of one or more limited-use thresholds;
receiving, from an access device, terminal transaction data associated with the transaction involving a good or a service;
generating, by the application of the communication device:
a transaction cryptogram using the LUK as an encryption key to encrypt at least a plurality of data elements from the terminal transaction data; and
a signature using at least a part of the terminal transaction data and the signature key;

sending, to the access device, a certificate authority public key index, an issuer public key certificate, and a communication device public key certificate, wherein the certificate authority public key index identifies a certificate authority public key that authenticates the issuer public key certificate, the issuer public key certificate includes an issuer public key that authenticates the communication device public key certificate, and the communication device public key certificate includes a communication device public key that authenticates the signature; and
sending, to the access device, the transaction cryptogram and the signature, the access device authenticating the application of the communication device without requiring network connectivity by verifying the signature using the communication device public key, granting access to the good or service after authenticating the application of the communication device and prior to verification of the transaction cryptogram, and obtaining authorization for the transaction from an issuer by verifying the transaction cryptogram with the issuer after access to the good or service has been granted.

2. The method of claim 1 , wherein generating the signature includes generating a hash value over at least a portion of the terminal transaction data, and applying a signing function with the signature key to at least the hash value.

3. The method of claim 1 , wherein the transaction cryptogram and the signature are sent to the access device in separate communications, and wherein the signature is sent to the access device after the transaction cryptogram.

4. The method of claim 1 , wherein the second set of one or more limited-use thresholds includes a time-to-live indicating a duration of time for which the signature key is valid.

5. The method of claim 4 , wherein the communication device public key certificate includes an indication of the time-to-live associated with the signature key.

6. The method of claim 1 , wherein the transaction cryptogram and the signature are generated in parallel with respect to each other.

7. The method of claim 1 , wherein the signature is generated in response to receiving the terminal transaction data from the access device indicating that the access device supports offline data authentication.

8. The method of claim 1 , wherein authenticating the application of the communication device includes verifying that the signature key used in generation of the signature has not exceeded the second set of one or more limited-use thresholds.

9. The method of claim 1 , wherein the second set of one or more limited-use thresholds includes a limited-use threshold that limits usage of the signature key to a plurality of transactions.

10. The method of claim 1 , wherein the second set of one or more limited-use thresholds includes a limited-use threshold that limits usage of the signature key to a total transaction amount across all transactions conducted using the signature key.

11. The method of claim 1 , wherein the LUK is a first LUK, and the first set of one or more limited-use thresholds limits usage of the first LUK to a first number of transactions, and the method further comprises:
receiving, from the remote computer, a second LUK when the first LUK expires, the second LUK associated with a second set of one or more limited-use thresholds that limits usage of the second LUK to a second number of transactions, the second number of transactions being different than the first number of transactions.

12. The method of claim 1 , wherein the communication device public key certificate and the issuer public key certificate are sent to the access device in separate communications, and wherein the communication device public key certificate is sent to the access device after the issuer public key certificate.

13. The method of claim 1 , wherein the first set of one or more limited-use thresholds includes a limited-use threshold that limits usage of the LUK to a plurality of transactions.

14. The method of claim 1 , wherein the second set of one or more limited-use thresholds includes a limited-use threshold that limits usage of the signature key to a cumulative number of transactions conducted using multiple signature keys that are associated with the certificate authority public key.

15. The method of claim 1 , wherein the second set of one or more limited-use thresholds includes a limited-use threshold that limits usage of the signature key to a cumulative transaction amount across transactions conducted using multiple signature keys that are associated with the certificate authority public key.

16. The method of claim 1 , wherein generating the signature includes generating a hash value by applying a hash function to a data set that includes a terminal unpredictable number and a communication device unpredictable number.

17. The method of claim 1 , wherein generating the signature includes generating a hash value by applying a hash function to a data set that includes a signed data format indicating a format of the signature being generated, and a hash algorithm indicator indicating the hash function being used.

18. The method of claim 17 , wherein the data set further includes an application transaction counter value.

19. The method of claim 17 , wherein generating the signature further includes applying a signing function using the signature key to a set of data elements including the generated hash value.

20. The method of claim 19 , wherein the set of data elements for the signing function further includes the signed data format indicating the format of the signature being generated, and the hash algorithm indicator indicating the hash function being used.

Assignees

• Visa Int Service Ass

Inventors

• Wong Erick
• Aabye Christian
• Flurscheim Christian
• Jones Christopher

Classifications

• G06Q20/4015 Primary

  using location information · CPC title

• H04W12/065

  Continuous authentication · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title