Secure on-demand ultra-wideband communication channels systems and methods

Patent metadata

Field	Value
Publication number	US-12219347-B2
Application number	US-202318453693-A
Country	US
Kind code	B2
Filing date	Aug 22, 2023
Priority date	Sep 30, 2021
Publication date	Feb 4, 2025
Grant date	Feb 4, 2025

Abstract

A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultra-wideband communication channel between the user device and the access device.

First claim

What is claimed is:

1. A method comprising:
forming a communication channel between a user device and an access device, wherein the communication channel is a primary communication channel;
securing the communication channel between the user device and the access device using a user device key pair in the user device and an access device ephemeral key pair in the access device;
generating, by the access device, a session key using at least a private cryptographic key in the access device ephemeral key pair and a public cryptographic key in the user device key pair;
using, by the access device, the session key to secure an ultra-wideband communication channel between the user device and the access device;
determining, by the access device, a distance between the access device and the user device based on the ultra-wideband communication channel;
comparing the distance and a predetermined threshold distance; and
if the distance does not exceed the predetermined threshold distance, performing further communications with the user device over the primary communication channel, the user device being a payment device.

2. The method of claim 1 , wherein the session key is used in a scrambled timestamp, secure ranging, or pulse reordering security process to secure the ultra-wideband communication channel.

3. The method of claim 1 , wherein the session key is a first session key and wherein the method further comprises:
generating a second session key using at least a cryptographic key of the access device ephemeral key pair, and using the second session key to form an ultra-wideband communication credential for the ultra-wideband communication.

4. The method of claim 1 , wherein the user device key pair and the access device ephemeral key pair are elliptic curve cryptography (ECC) key pairs.

5. The method of claim 1 , wherein the ultra-wideband communication channel is used in a relay attack prevention process, the relay attack prevention process including determining the distance between the user device and the access device.

6. The method of claim 1 , wherein the primary communication channel is a close range communication channel.

7. The method of claim 1 further comprising:
if the distance does not exceed the predetermined threshold distance, performing, by the access device, an interaction process to obtain interaction data from the user device for an interaction between a user of the user device and a resource provider of the access device;
generating, by the access device, an authorization request message comprising at least the interaction data; and
providing, by the access device, the authorization request message to an authorizing entity computer for authorization via a resource provider computer.

8. The method of claim 7 further comprising:
receiving, by the access device, an authorization response message comprising an indication of whether or not the interaction is authorized.

9. The method of claim 1 , wherein securing the communication channel between the user device and the access device further comprises:
providing, by the access device, an access device ephemeral public key of the access device ephemeral key pair to the user device;
receiving, by the access device, the public cryptographic key in the user device key pair;
generating, by the access device, a shared secret using a user device public key and the private cryptographic key of the access device ephemeral key pair; and
securing, by the access device, the communication channel using the shared secret.

10. The method of claim 1 , wherein the access device is a POS terminal.

11. An access device comprising:
a processor; and
a non-transitory computer-readable medium coupled to the processor, the non-transitory computer-readable medium comprising code executable by the processor for implementing a method comprising:
forming a communication channel between a user device and the access device, wherein the communication channel is a primary communication channel;
securing the communication channel between the user device and the access device using a user device key pair in the user device and an access device ephemeral key pair in the access device;
generating, by the access device, a session key using at least a private cryptographic key in the access device ephemeral key pair and a public cryptographic key in the user device key pair;
using the session key to secure an ultra-wideband communication channel between the user device and the access device;
determining, by the access device, a distance between the access device and the user device based on the ultra-wideband communication channel;
comparing the distance and a predetermined threshold distance; and
if the distance does not exceed the predetermined threshold distance, performing further communications with the user device over the primary communication channel, the user device being a payment device.

12. The access device of claim 11 , wherein using the session key to secure the ultra-wideband communication channel between the user device and the access device further comprises:
generating an authentication challenge;
providing the authentication challenge to the user device, wherein the authentication challenge is encrypted using the session key, and wherein the user device generates a message integrity code over the authentication challenge, and provides the message integrity code to the access device in response to the authentication challenge;
receiving the message integrity code from the user device; and
verifying the message integrity code.

13. The access device of claim 11 further comprising, on the computer-readable medium:
a primary communication channel creation module;
a communication channel securing module;
an ultra-wideband communication channel creation module; and
an interaction processing module.

14. The access device of claim 11 , wherein the method further comprises:
performing an interaction process to obtain interaction data from the user device for an interaction;
generating, by the access device, an authorization request message comprising at least the interaction data; and
providing, by the access device, the authorization request message to an authorizing entity computer for authorization.

15. The access device of claim 11 , wherein the access device is a first mobile device, and wherein the user device is a second mobile device.

16. The access device of claim 11 , wherein the session key is a first session key and wherein the method further comprises:
generating a second session key using at least a cryptographic key of the access device ephemeral key pair, and using the second session key to form an ultra-wideband communication credential for the ultra-wideband communication.

17. A method comprising:
forming a communication channel between a user device and an access device;
securing the communication channel between the user device and the access device using a user device key pair in the user device and an access device ephemeral key pair in the access device;
generating, by the user device, a session key using at least a private cryptographic key in the user device key pair and a public cryptographic key in the access device ephemeral key pair;
using, by the user device, the session key to secure an ultra-wideband communication channel between the user device and the access device
determining a distance between the access device and the user device based on the ultra-wideband communication channel;
comparing the distance and a predetermined threshold distanc

Assignees

• Visa Int Service Ass

Inventors

• Sullivan Brian
• Girish Aparna
• Rigby Mark
• Aabye Christian
• Top Mustafa
• Chen Yuexi
• Sloan Dinah
• Ngo Hao

Classifications

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04W12/106

  Packet or message integrity · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04W12/08

  Access security · CPC title