Zero-knowledge proof-based virtual cards

Patent metadata

Field	Value
Publication number	US-11538019-B1
Application number	US-202016894000-A
Country	US
Kind code	B1
Filing date	Jun 5, 2020
Priority date	Jun 5, 2020
Publication date	Dec 27, 2022
Grant date	Dec 27, 2022

Abstract

Disclosed are various embodiments for issuing virtual cards to client devices. Also disclosed are embodiments for provisioning a transaction terminal to process transactions with virtual cards. A zero-knowledge proof algorithm can be utilized to validate the transactions. A virtual card can be based upon a public key of a client device that is managed by a hardware security module.

First claim

Therefore, the following is claimed:

1. A system, comprising:
at least one computing device; and
at least one application executable by the at least one computing device, wherein, when executed by the at least one computing device, the at least one application causes the at least one computing device to at least:
generate a verifier kit corresponding to a zero-knowledge proof algorithm, the verifier kit associated with an issuer and the verifier kit being an application that verifies a proof generated according to the zero-knowledge proof algorithm;
provide the verifier kit to a transaction terminal;
generate a prover kit corresponding to the zero-knowledge proof algorithm, the prover kit being an application by which the proof according to the zero-knowledge proof algorithm can be generated;
generate a virtual card corresponding to an account with the issuer, the virtual card being uniquely associated with the account, the virtual card comprising the prover kit and a public key associated with a client device that is signed by a private key of the issuer;
register the virtual card with the account within the issuer; and
provision the client device with the virtual card, wherein the client device is configured to generate the proof corresponding to the zero-knowledge proof algorithm to prove that the client device is authorized to conduct a transaction using the provisioned virtual card by executing the prover kit of the provisioned virtual card, and wherein the transaction terminal is configured to verify the proof generated by the client device using the verifier kit to authorize the transaction.

2. The system of claim 1 , wherein the virtual card further comprises at least one commitment parameter, the at least one commitment parameter being encrypted with a public key of the client device, and the at least one commitment parameter further defining at least one restriction associated with the virtual card.

3. The system of claim 2 , wherein the at least one commitment parameter is signed using a certificate of the issuer.

4. The system of claim 1 , wherein the virtual card further comprises a public key associated with the client device and the at least one application, when executed, registers the virtual card with the issuer by causing the at least one computing device to at least:
write the public key associated with the client device to a distributed ledger, wherein the issuer publishes a plurality of public keys corresponding to issued virtual cards to the distributed ledger.

5. The system of claim 4 , wherein the at least one application, when executed, further causes the at least one computing device to at least:
revoke the virtual card by publishing a revocation message corresponding to the virtual card to the distributed ledger.

6. The system of claim 1 , wherein the at least one application, when executed, provides the verifier kit to the transaction terminal by causing the at least one computing device to at least:
write an identity of the verifier kit to a distributed ledger, wherein the transaction terminal retrieves the identity of the verifier kit from the distributed ledger.

7. The system of claim 1 , wherein, when executed, the at least one application provisions the client device with the virtual card by further causing the at least one computing device to sign a public key associated with the client device with a certificate of the issuer.

8. A method comprising:
generating, by at least one computing device, a verifier kit corresponding to a zero-knowledge proof algorithm, the verifier kit associated with an issuer and the verifier kit being an application that verifies a proof generated according to the zero-knowledge proof algorithm;
providing, by the at least one computing device, the verifier kit to a transaction terminal;
generating, by the at least one computing device, a prover kit corresponding to the zero-knowledge proof algorithm, the prover kit being an application by which the proof according to the zero-knowledge proof algorithm can be generated;
generating, by the at least one computing device, a virtual card corresponding to an account with the issuer, the virtual card being uniquely associated with the account, the virtual card comprising the prover kit and a public key associated with a client device that is signed by a private key of the issuer;
registering, in the at least one computing device, the virtual card with the account within the issuer; and
provisioning, by the at least one computing device, wherein the client device is configured to generate the proof corresponding to the zero-knowledge proof algorithm to prove that the client device is authorized to conduct a transaction using the provisioned virtual card by executing the prover kit of the provisioned virtual card, and wherein the transaction terminal is configured to verify the proof generated by the client device using the verifier kit to authorize the transaction.

9. The method of claim 8 , wherein the virtual card further comprises at least one commitment parameter, the at least one commitment parameter being encrypted with a public key of the client device, and the at least one commitment parameter further defining at least one restriction associated with the virtual card.

10. The method of claim 9 wherein the at least one commitment parameter is signed using a certificate of the issuer.

11. The method of claim 8 , wherein the virtual card further comprises a public key associated with the client device and registering the virtual card with the issuer further comprise:
writing, by the at least one computing device, the public key associated with the client device to a distributed ledger, wherein the issuer publishes a plurality of public keys corresponding to issued virtual cards to the distributed ledger.

12. The method of claim 11 , further comprising:
revoking, by the at least one computing device, the virtual card by publishing a revocation message corresponding to the virtual card to the distributed ledger.

13. The method of claim 8 , further comprising:
writing, by the at least one computing device, an identity of the verifier kit to a distributed ledger, wherein the transaction terminal retrieves the identity of the verifier kit from the distributed ledger.

14. The method of claim 8 , wherein provisioning the client device with the virtual card further comprises signing a public key associated with the client device with a certificate of the issuer.

15. A non-transitory computer-readable medium embodying instructions executable by at least one computing device, the instructions, when executed, causing the at least one computing device to at least:
generate a verifier kit corresponding to a zero-knowledge proof algorithm, the verifier kit associated with an issuer and the verifier kit being an application that verifies a proof generated according to the zero-knowledge proof algorithm;
provide the verifier kit to a transaction terminal;
generate a prover kit corresponding to the zero-knowledge proof algorithm, the prover kit being an application by which the proof according to the zero-knowledge proof algorithm can be generated;
generate a virtual card corresponding to an account with the issuer, the virtual card being uniquely associated with the account, the virtual card comprising the prover kit and a public key associated with a client device that is signed by a private key of the issuer;
register the virtual card with the account within the issuer; and
provision the client device with the virtual card, wherein the client device is configured to generate the proof correspo

Assignees

• American Express Travel Related Services Co Inc

Inventors

• Ferenczi Andras L

Classifications

• G06Q20/4012

  Verifying personal identification numbers [PIN] · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/3221

  interactive zero-knowledge proofs · CPC title

• G06Q20/3226

  Use of secure elements separate from M-devices · CPC title

• G06Q20/38215

  Use of certificates or encrypted proofs of transaction rights · CPC title