Secure multi-party protocol

Patent metadata

Field	Value
Publication number	US-12095746-B2
Application number	US-202318311190-A
Country	US
Kind code	B2
Filing date	May 2, 2023
Priority date	Nov 25, 2015
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

A requestor and a responder may conduct secure communication by making API calls based on a secure multi-party protocol. The requestor may send a request data packet sent in a API request to the responder, where the request data packet can include at least a control block that is asymmetrically encrypted and a data block that is symmetrically encrypted. The responder may return a response data packet to the requestor, where the response data packet can include at least a control block and a data block that are both symmetrically encrypted. The requestor and the responder may derive the keys for decrypting the encrypted portions of the request and response data packets based on some information only known to the requestor and the responder. The secure multi-party protocol forgoes the need to store and manage keys in a hardware security module.

First claim

What is claimed is:

1. A method of securing communications between a first computer and a second computer, wherein the method comprises:
receiving, by the first computer, a response data packet comprising a first leader block comprising an entity name, an encrypted control block and an encrypted data block from the second computer over a communications network;
generating, by the first computer, a symmetric key using a predetermined algorithm;
decrypting, by the first computer, the encrypted control block with the generated symmetric key to obtain a control block; and
decrypting, by the first computer, the encrypted data block with a cryptographic key that is determined using data in the control block to obtain a data block, wherein the response data packet is received after the first computer sends a request data packet to the second computer, the request data packet comprising a second leader block comprising the entity name.

2. The method of claim 1 , wherein the cryptographic key used to encrypt the data block is a symmetric key, which is an ephemeral key.

3. The method of claim 2 , wherein the symmetric key is generated using a shared secret and a variable datum.

4. The method of claim 3 , wherein the variable datum is a salt.

5. The method of claim 1 , wherein the encrypted data block is formed by encrypting the data block with a symmetric key.

6. The method of claim 1 , wherein data utilized to generate the symmetric key is in the first leader block in the response data packet.

7. The method of claim 1 wherein the first computer is an authorization entity computer and the second computer is a token service computer.

8. The method of claim 1 , wherein the response data packet comprises a signature block.

9. The method of claim 8 , wherein the first leader block includes information indicating an encryption algorithm utilized to obtain the symmetric key for decrypting the encrypted control block.

10. The method of claim 8 , wherein the symmetric key is a second symmetric key, the encrypted control block is an encrypted second control block, the encrypted data block is an encrypted second data block and the data block is a second data block, and the request data packet comprises an encrypted first control block and an encrypted first data block.

11. A first computer comprising:
a processor; and
a computer readable medium coupled with the processor, the computer readable medium comprising code executable to perform a method comprising:
receiving, by the first computer, a response data packet comprising a first leader block comprising an entity name, an encrypted control block and an encrypted data block from a second computer over a communications network;
generating, by the first computer, a symmetric key using a predetermined algorithm;
decrypting, by the first computer, the encrypted control block with the generated symmetric key to obtain a control block; and
decrypting, by the first computer, the encrypted data block with a cryptographic key that is determined using data in the control block to obtain a data block, wherein the response data packet is received after the first computer sends a request data packet to the second computer, the request data packet comprising a second leader block comprising the entity name.

12. The first computer of claim 11 , wherein the cryptographic key used to encrypt the data block is a symmetric key, which is an ephemeral key.

13. The first computer of claim 11 , wherein the symmetric key is generated using a shared secret and a variable datum.

14. The first computer of claim 13 , wherein the variable datum is a salt.

15. The first computer of claim 11 , wherein the encrypted data block is formed by encrypting the data block with a symmetric key.

16. The first computer of claim 11 , wherein data utilized to generate the symmetric key is in the first leader block in the response data packet.

17. The first computer of claim 11 , wherein the first computer is an authorization entity computer and the second computer is a token service computer.

18. The first computer of claim 11 , wherein the response data packet comprises a signature block.

19. The first computer of claim 18 , wherein the first leader block includes information indicating an encryption algorithm utilized to obtain the symmetric key for decrypting the encrypted control block.

20. The method of claim 15 , wherein the first computer and the second computer interact via an API.

Assignees

• Visa Int Service Ass

Inventors

• Mansour Rasta A
• Law Simon

Classifications

• H04L9/0822

  using key encryption key · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/045 Primary

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title