Systems and methods for cryptographic authentication of contactless cards

Patent metadata

Field	Value
Publication number	US-11502844-B2
Application number	US-202016858357-A
Country	US
Kind code	B2
Filing date	Apr 24, 2020
Priority date	Oct 2, 2018
Publication date	Nov 15, 2022
Grant date	Nov 15, 2022

Abstract

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.

First claim

What is claimed is:

1. An authentication server, comprising:
a processor and a memory, the memory containing a master key and an identifier, wherein the processor is configured to:
receive a transmission comprising encrypted transmission data, wherein:
the encrypted transmission data is encrypted using one or more cryptographic algorithms and a diversified key, and
the diversified key is generated using a diversified master key and the one or more cryptographic algorithms;

generate an authentication diversified key based on the master key and the identifier;
generate a session key based on the authentication diversified key; and
decrypt the encrypted transmission data using the one or more cryptographic algorithms and the session key.

2. The authentication server of claim 1 , wherein the session key is limited to a single use.

3. The authentication server of claim 1 , wherein:
the memory contains a counter, and
the processor is configured to update the counter for each transmission received.

4. The authentication server of claim 1 , wherein a unique diversified session key is generated for each transmission.

5. The authentication server of claim 1 , wherein:
the transmission comprises a cryptographic result including a counter, and
the cryptographic result is generated using one or more cryptographic algorithms and the diversified key.

6. The authentication server of claim 5 , wherein a unique diversified session key is generated for each transmission using a portion of the counter.

7. The authentication server of claim 5 , wherein the diversified key is generated using the counter.

8. The authentication server of claim 1 , wherein the master key is limited to a predetermined number of uses.

9. The authentication server of claim 1 , wherein the authentication server is configured to receive the transmission from a transmitting device via one or more intermediary devices.

10. The authentication server of claim 9 , wherein the transmitting device comprises a contactless card and one of the one or more intermediary devices comprises a smartphone.

11. The authentication server of claim 10 , wherein the encrypted transmission data comprises activation data for a payment card.

12. A method for transmitting data by a transmitting device having a processor and a memory, the memory containing a master key and an identification number, the method comprising:
generating a device key using the master key and the identification number;
generating a first session key using the device key and a second session key using the device key;
generating a cryptogram using the first session key, the cryptogram including the identification number;
encrypting the cryptogram using the second session key; and
transmitting the encrypted cryptogram.

13. The method of claim 12 , wherein the first session key and the second session key are limited to a single use.

14. The method of claim 12 , wherein a unique diversified session key is generated for each transmission by the transmitting device.

15. The method of claim 14 , wherein the memory contains a counter, comprising:
generating a cryptographic result including the counter using one or more cryptographic algorithms and the device key; and
transmitting the cryptographic result.

16. The method of claim 15 , wherein the first session key is generated using a first portion of the counter.

17. The method of claim 16 , wherein the second session key is generated using a second portion of the counter.

18. The method of claim 12 , wherein the master key is limited to use during a predetermined time period.

19. The method of claim 12 , wherein the transmitting device comprises a contactless card and the cryptogram comprises activation data for the contactless card.

20. A contactless card, comprising:
a substrate;
a memory containing a master key and an identification number; and
a processor,
wherein the processor is configured to:
generate a device key using the master key and the identification number,
generate a first session key using the device key and a second session key using the device key,
generate a cryptogram using the first session key, the cryptogram including the identification number,
encrypt the cryptogram using the second session key, and
transmit the encrypted cryptogram.

21. The contactless card of claim 20 , wherein the first session key and the second session key are limited to a single use.

22. The contactless card of claim 20 , wherein:
the memory contains a counter, and
the processor is configured to:
generate a cryptographic result including the counter using one or more cryptographic algorithms and the device key, and
transmit the cryptographic result.

23. The contactless card of claim 22 , wherein the first session key is generated using a first portion of the counter.

24. The contactless card of claim 23 , wherein the second session key is generated using a second portion of the counter.

25. The contactless card of claim 22 , wherein the counter comprises a one-time passcode.

26. The contactless card of claim 20 , wherein:
the memory contains a random nonce, and
the processor is configured to generate the first session key using the random nonce.

27. The contactless card of claim 26 , wherein the processor is configured to generate the random nonce prior to each generation of the first session key.

28. The contactless card of claim 20 , wherein the master key is limited to use during a predetermined time period.

29. The contactless card of claim 20 , wherein:
the cryptogram comprises activation data for the contactless card, and
the processor is configured to transmit the encrypted cryptogram to an authentication server via one or more intermediary devices.

30. The contactless card of claim 20 , wherein one of the one or more intermediary devices comprises a smartphone.

Assignees

• Capital One Services Llc

Inventors

• Osborn Kevin
• Rule Jeffrey
• Moreton Paul
• Duane William
• Hart Colin
• Newman Kaitlin
• Mossler Lara
• Herrington Daniel
• Chigurupati Srinivasa
• Prince Ian
• Lutz Wayne

Classifications

• H04L9/002

  Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441) · CPC title

• H04L9/3234 Primary

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• G06Q20/36

  using electronic wallets or electronic money safes · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title