Systems and methods for contactless card communication and multi-device key pair cryptographic authentication

Patent metadata

Field	Value
Publication number	US-12301735-B2
Application number	US-202117352181-A
Country	US
Kind code	B2
Filing date	Jun 18, 2021
Priority date	Jun 18, 2021
Publication date	May 13, 2025
Grant date	May 13, 2025

Abstract

Systems and methods for authentication may include an authenticator. The authenticator may include a processor and a memory. The processor may be configured to: receive one or more challenges; generate a first instruction, the first instruction including a request to retrieve a first Fast Identity Online (FIDO) key; transmit the first instruction; receive the first FIDO key; sign the one or more challenges using the first FIDO key; and transmit one or more signed challenges for validation using a second FIDO key.

First claim

We claim:

1. An authentication system for enabling a Fast Identification Online (FIDO) authentication into a browser application of a computing device, the authentication system comprising:
a contactless card having a near-field communication (NFC) interface; and
an authenticator device, the authenticator device having an NFC connectivity to the contactless card and a first application for communicating with a relying server,
wherein the authenticator device:
receives, a FIDO challenge generated by the relying server, the FIDO challenge being transmitted by the relying server in response to a FIDO authentication request initiated from the browser application of the computing device,
transmits a first instruction, via the NFC connectivity, to the contactless card, the first instruction including a request to retrieve a first FIDO key from the contactless card,
signs the FIDO challenge, received from the relying server, using the first FIDO key retrieved from the contactless card, and
transmits, via the first application, the signed FIDO challenge to the relying server for validation using a second FIDO key,

wherein the first FIDO key is generated based on a master key and an identifier associated with the FIDO authentication request using one or more cryptographic algorithms.

2. The authentication system of claim 1 , wherein the first instruction includes a request to generate the first FIDO key.

3. The authentication system of claim 1 , wherein the second FIDO key corresponds to a public key of the first FIDO key.

4. The authentication system of claim 1 , wherein the first instruction includes a request to regenerate the first FIDO key.

5. The authentication system of claim 1 , wherein the FIDO challenge is received in response to an authentication request for a FIDO website registration.

6. The authentication system of claim 1 , wherein the authenticator device receives input data including at least one selected from the group of biometric data and credential data.

7. The authentication system of claim 1 , wherein the first FIDO key is retrieved via entry of the NFC interface into a communication field of the authenticator device.

8. The authentication system of claim 6 , wherein the input data is transmitted after determination of one or more conditions.

9. A method of contactless Fast Identity Online authentication into a browser application of a computing device, the method comprising the steps of:
receiving, by a first application executing on an authenticator device, a FIDO challenge generated by a relying server in response to a FIDO authentication request initiated from the computing device,
transmitting, by the authenticator device, a first instruction, to a contactless card, the first instruction including a request to retrieve a first FIDO key from the contactless card;
signing, by the first application of the authenticator device, the FIDO challenge received from the relying server, using the first FIDO key retrieved from the contactless card; and
transmitting, via the first application, the signed FIDO challenge to the relying server for validation using a second FIDO key,
wherein the first FIDO key is generated based on a master key and an identifier associated with the FIDO authentication request using one or more cryptographic algorithms.

10. The method of claim 9 , wherein the first instruction includes a request to generate the first FIDO key.

11. The method of claim 9 , wherein the second FIDO key corresponds to a public key of the first FIDO key.

12. The method of claim 9 , wherein the first instruction includes a request to regenerate the first FIDO key.

13. The method of claim 9 , wherein the FIDO challenge is received in response to an authentication request for FIDO website registration.

14. The method of claim 9 , further comprising receiving, by the authenticator device, input data including at least one selected from the group of biometric data and credential data.

15. The method of claim 9 , wherein the first FIDO key is retrieved by the authenticator device via entry of a communication interface, associated with the contactless card, into a communication field associated with the authenticator device.

16. The method of claim 14 , wherein the input data is transmitted after determination of one or more conditions.

17. The method of claim 16 , wherein at least one condition comprises determining a threshold number of authentication requests over a predetermined time period.

18. A computer readable non-transitory medium comprising computer executable instructions that, when executed on a processor of an authenticator device, cause the processor to perform procedures comprising the steps of:
receiving, by a first application executing on an authenticator device, a Fast Identity Online (FIDO) challenge generated by a relying server in response to a FIDO authentication request initiated from a computing device;
transmitting, by the authenticator device, a first instruction, to a contactless card, the instruction including a request to retrieve a first Fast Identity Online (FIDO) key from the contactless card;
signing, by the first application of the authenticator device, the FIDO challenge received from the relying server, using the first FIDO key retrieved from the contactless card; and
transmitting, via the first application, the signed FIDO challenge to the relying server for validation using a second FIDO key,
wherein the first FIDO key is generated based on a master key and an identifier associated with the FIDO authentication request using one or more cryptographic algorithms.

Assignees

• Capital One Services Llc

Inventors

• Rule Jeffrey
• Osborn Kevin
• Lutz Wayne

Classifications

• H04L9/3247 Primary

  involving digital signatures · CPC title

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title