System and methods for secure firmware validation

Patent metadata

Field	Value
Publication number	US-9965632-B2
Application number	US-201615099048-A
Country	US
Kind code	B2
Filing date	Apr 14, 2016
Priority date	Dec 22, 2014
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

An electronic device, such as a dynamic transaction card having an EMV chip, that acts as a TPM having a memory, an applet, and a cryptographic coprocessor performs secure firmware and/or software updates, and performs firmware and/or software validation for firmware and/or software that is stored on the electronic device. Validation may compare a calculated checksum with a checksum stored in EMV chip memory. If a checksum calculated for firmware and/or a software application matches a checksum stored in EMV chip memory of the transaction card, the transaction card may operate normally. If a checksum calculated for firmware and/or a software application does not match a checksum stored in EMV chip memory of the transaction card, the transaction card may freeze all capabilities, erase the memory of the transaction card, display data indicative of a fraudulent or inactive transaction card, and/or the like.

First claim

The invention claimed is:

1. A dynamic transaction card comprising:
A EuroPay-MasterCard-Visa (EMV) processor storing existing firmware and version data associated with the existing firmware;
an EMV plate connectively coupled to the EMV processor;
a bootloader;
an input/output interface that receives an updated firmware program from a firmware provider system;
an applet comprising instructions that when executed, cause the EMV chip to perform a checksum validation; and
data storage storing a first checksum calculated using the stored firmware upon loading of the firmware, wherein firmware is validated on the dynamic transaction card by performing the following:
receiving at the EMV processor, a trigger that triggers checksum validation via the applet;
reading, via the applet, the firmware to determine data comprising the first checksum;
receiving at the EMV processor, the data comprising the first checksum;
calculating, using the EMV processor, a second checksum associated with the firmware;
comparing, using the EMV processor, the first checksum and the second checksum;
validating the updated firmware upon determining that the received checksum and the calculated checksum are equal; and
deleting at least a portion of data in the data storage and the EMV processor upon determining that the first checksum and the second checksum are not equal;

wherein the EMV processor receives, via contacts on the EMV plate, an update component associated with the updated firmware program transmitted from the firmware provider system during a secure communication with the firmware provider system via a secure terminal, wherein the update component is used to validate the received updated firmware program;
wherein, in response to the validation of the updated firmware program, the bootloader loads the updated firmware on the dynamic transaction card, executes the updated firmware program, which overwrites the existing firmware; and
wherein, in response to the bootloader loading and executing the updated firmware program, the EMV processor stores and uses the updated firmware program.

2. The dynamic transaction card of claim 1 , wherein the EMV processor comprises a cryptographic coprocessor.

3. The dynamic transaction card of claim 1 , wherein the updated firmware program is transmitted during and/or at the end of an EMV transaction.

4. The dynamic transaction card of claim 1 , wherein the updated firmware program is transmitted via secure transaction tokens.

5. The dynamic transaction card of claim 1 , wherein the updated firmware program comprises a cryptographic key to decrypt the updated firmware.

6. The dynamic transaction card of claim 1 , wherein the updated firmware program comprises a checksum associated with the updated firmware.

7. The dynamic transaction card of claim 1 , further comprising data storage for cryptographic keys, checksums, and/or validation data associated with the firmware stored on the dynamic transaction card.

8. The dynamic transaction card of claim 1 , wherein upon determining that the updated firmware validation failed, the EMV processor executes an erase script to erase at least a portion of memory of the dynamic transaction card and/or deactivates the card.

9. The dynamic transaction card of claim 1 , further comprising at least one plastic jumper which connects electrical components of the dynamic transaction card, wherein upon tampering with the dynamic transaction card, the at least one plastic jumper dissolves to break the connection between the electrical components.

10. The dynamic transaction card of claim 1 , wherein upon determining that the updated firmware validation failed, the EMV processor transmits a notification to the firmware provider system, a mobile device paired with the dynamic transaction card, and/or a third party system.

11. The dynamic transaction card of claim 1 , wherein upon determining that the first checksum and the second checksum are not equal, the EMV processor executes an erase script to erase at least a portion of memory of the dynamic transaction card and/or deactivates the card.

12. The dynamic transaction card of claim 1 , wherein upon determining that the first checksum and the second checksum are not equal, the EMV processor transmits a notification to the firmware provider system, a mobile device paired with the dynamic transaction card, and/or a third party system.

13. The dynamic transaction card of claim 1 , further comprising at least one plastic jumper which connects electrical components of the dynamic transaction card, wherein upon tampering with the dynamic transaction card, the at least one jumper dissolves to break the connection between the electrical components.

14. The dynamic transaction card of claim 1 , wherein the cryptographic coprocessor comprises a random number generator, a key generator, a hash generator, and/or an encryption/decryption engine.

15. A method for updating firmware on a dynamic transaction card comprising:
storing existing firmware and version data associated with the existing firmware in a EuroPay-MasterCard-Visa (EMV) processor contained within the dynamic transaction card;
receiving, at the EMV processor via an input/output interface connectively coupled to the EMV processor, an updated firmware program transmitted from a firmware provider system;
receiving, at the EMV processor via an EMV plate connectively coupled to the EMV processor, an update component associated with the updated firmware program from the firmware provider system during a secure communication with the firmware provider system via a secure terminal;
validating, using the EMV processor, the received updated firmware program an EMV processor storing existing firmware and version data associated with the existing firmware;
loading, via a bootloader, the updated firmware, in response to validating the updated firmware;
upon loading the firmware, calculating a first checksum using the stored firmware;
storing the first checksum in data storage;
receiving at the EMV processor, a trigger that triggers checksum validation via an applets;
reading, via the applet, the firmware to determine data comprising the first checksum;
receiving at the EMV processor, the data comprising the first checksum;
calculating, using the EMV processor, a second checksum associated with the firmware;
comparing using the EMV processor, the first checksum and the second checksum;
validating the updated firmware upon determining that the received checksum and the calculated checksum are equal; and
deleting at least a portion of data in the data storage and the EMV processor upon determining that the first checksum and the second checksum are not equal;

executing the updated firmware;
overwriting the existing firmware; and
storing and using the updated firmware in response to the bootloader loading and executing the updated firmware.

16. The method for updating firmware on a dynamic transaction card of claim 15 , wherein the EMV processor comprises a cryptographic coprocessor.

17. The method for updating firmware on a dynamic transaction card of claim 15 , further comprising transmitting the updated firmware program during and/or at the end of an EMV transaction.

18. The method for updating firmware on a dynamic transaction card of claim 15 , further comprising transmitting the updated firmware program via secure transaction tokens.

19. The method for updating firmware on a dynamic transaction card of claim 15 , wherein the updated firmware program comprises a cryp

Assignees

• Capital One Services Llc
• Capital One Services Llc

Inventors

• ZARAKAS James
• Wurmfeld David
• York Brennon
• LOCKE Tyler

Classifications

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• G06K19/0723

  the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs · CPC title

• G06F2221/2153

  Using hardware token as a secondary aspect · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title