Systems and methods for data access control of secure memory using a short-range transceiver

Patent metadata

Field	Value
Publication number	US-2021119797-A1
Application number	US-202016906653-A
Country	US
Kind code	A1
Filing date	Jun 19, 2020
Priority date	Oct 18, 2019
Publication date	Apr 22, 2021
Grant date	—

Abstract

Systems and methods for controlling data access through the interaction of a short-range transceiver, such as a contactless card, with a client device are presented. Data access control may be provided in the context of creating and accessing a secure memory block in a client device, including handling requests to obtain create and access a secure memory block via the interaction of a short-range transceiver, such as a contactless card, with a client device such that, once the secure memory block is created in memory of the client device, personal user data may be stored in the secure memory block, and access to the stored personal user data may only be provided to users authorized to review the data. An exemplary system and method may include receiving from a client device of the user a user token and a request for a data storage key, the request generated in response to a tap action between a contactless card and the client device, the contactless card associated with the user, verifying that the user is authorized to create a secure memory data block on the client device, and transmitting to the client device the data storage key, such that the client device may create a secure memory data block in memory of the client device and encrypt the secure memory data block using the data storage key.

First claim

1 - 20 . (canceled)

21 . A data access control system, comprising:
a contactless card comprising a communications interface, a processor, and a memory, the memory storing a user token, wherein the user token comprises a user key; a client application comprising instructions for execution on a client device, the client application configured to:
in response to a tap action between the contactless card and the client device, receive the user token from the contactless card, and transmit the user token and a request for a data storage key;
receive, in response to the request, the data storage key, wherein the data storage key is generated from the user key;
create a secure memory block in a memory of the client device; and
encrypt the secure memory block using the data storage key.

22 . The data access control system of claim 21 , further comprising a server configured for data communication with the client device, wherein the server is configured to:
receive from the client device the user token and the request for the data storage key, identify a user based on the user token, verify that the user is authorized to create the secure memory block in the client device, and transmit to the client device the data storage key.

23 . The data access control system of claim 22 , wherein the server is further configured to authenticate the user based on the user key.

24 . The data access control system of claim 22 , wherein the client application is further configured to:
in response a tap action between the contactless card and the client device, transmit to the server the user token and a request for a data access key; receive from the server the data access key; and decrypt the secure memory block using the data access key.

25 . The data access control system of claim 24 , wherein the server is further configured to
receive from the client device the user token and the request for the data access key; identify the user based on the user token; verify that the user is authorized to access the secure memory block in the client device; and transmit to the client device the data access key.

26 . The data access control system of claim 24 , wherein the client application is further configured to re-encrypt the secure memory block after a predetermined time period.

27 . The data access control system of claim 24 , wherein the user token comprises a user key, and the data access key is generated from the user key.

28 . The data access control system of claim 21 , wherein the client application is further configured to store personal user data in the secure memory block.

29 . The data access control system of claim 28 , wherein the personal user data comprises a digital driver's license.

30 . The data access control system of claim 28 , wherein the client application is further configured to permit a second application on the client device to access the personal user data.

31 . The data access control system of claim 21 , wherein the user token comprises a user key, and wherein the client application is further configured to:
in response to a tap action between the contactless card and the client device, receive the user token from the contactless card; verify that a user associated with the user token is authorized to access the secure memory block in the client device; generate a data access key based on the user key; and decrypt the secure memory block using the data access key.

32 . The data access control system of claim 30 , wherein the user token further comprises a user identifier.

33 . A method for controlling data access, comprising:
providing a contactless card comprising a communications interface, a processor, and a memory, the memory storing a user token, the user token comprising a user key; providing a client application comprising instructions for execution on a client device, the client device having an encrypted secure memory block storing personal user data, the client application configured to:
in response to a tap action between the contactless card and the client device, receive the user token from the contactless card, and transmit the user token and a request for a data access key;
receive the data access key, wherein the data access key is generated based on the user key; and
decrypt the secure memory block using the data access key;
receiving from the client device the user token and the request for the data access key; identifying the user based on the user token; verifying that the user is authorized to access the secure memory block in the client device; and transmitting to the client device the data access key.

34 . The method of claim 33 , wherein the client application is further configured to re-encrypt the secure memory block upon receipt of a re-encryption instruction.

35 . The method of claim 33 , wherein decrypt the secure memory block using the data access key comprises combining the data access key with data received from the contactless card to generate a new key used for performing the decryption.

36 . The method for controlling data access of claim 33 , further comprising providing a server, the server configured to:
receive the user token and the request for the data access; identify a user based on the user token; verify that the user is authorized to access the secure memory block in the client device; and transmit to the client device the data access key.

37 . The method of claim 36 , wherein the server is further configured to authenticate the user based on the user key.

38 . The method of claim 33 , wherein the client application is further configured to receive biometric information prior to decrypting the secure memory block.

39 . A non-transitory machine-readable medium having stored thereon an application comprising program code for execution on a client device, the client device configured to communicate over a short-range communication field with a contactless card, the contactless card comprising memory storing a user token comprising a user key, the application configured to, when executed, perform procedures comprising:
in response to a tap action between the contactless card and the client device, receiving the user token from the contactless card, and transmitting the user token and a request for a data storage key; receiving, in response to the request, the data storage key, wherein the data storage key is generated from the user key; creating a secure memory block in a memory of the client device; storing personal user data in the secure memory block; and encrypting the secure memory block using the data storage key.

40 . The non-transitory machine-readable medium of claim 39 , wherein the user token comprises a user key, and wherein the application is further configured to, when executed, perform procedures comprising:
in response to a tap action between the contactless card and the client device, receiving the user token from the contactless card; verifying that a user associated with the user token is authorized to access the secure memory block in the client device; generating a data access key based on the user key; decrypting the secure memory block using the data access key; and re-encrypting the secure memory block using the data storage key.

Assignees

• Capital One Services Llc

Inventors

• Wieker Jeffrey
• Zearfoss Patrick
• Johnson Clayton

Classifications

• G06F21/35 Primary

  communicating wirelessly · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F3/06

  Digital input from, or digital output to, record carriers {, e.g. RAID, emulated record carriers or networked record carriers} · CPC title

• H04W12/47

  using near field communication [NFC] or radio frequency identification [RFID] modules · CPC title