Efficient methods for protecting identity in authenticated transmissions

• US 10,129,020 B2
• Filed: 03/13/2018
• Issued: 11/13/2018
• Est. Priority Date: 01/13/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Le Saint, Eric
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US15/920,271
• Publication Number:
  US 20180205539A1
• Time in Patent Office: 245 Days
• Field of Search: 713171
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04W 12/041 Key generation or derivation

Abstract

Systems and methods are provided for protecting identity in an authenticated data transmission. For example, a contactless transaction between a portable user device and an access device may be conducted without exposing the portable user device'"'"'s public key in cleartext. In one embodiment, an access device may send an access device public key to a portable user device. The user device may return a blinded user device public key and encrypted user device data. The access device may determine a shared secret using the blinded user device public key and an access device private key. The access device may then decrypt the encrypted user device data using the shared secret.

Claims

1. An access device, comprising:

a processor; and

a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising;

receiving, from a user device, a message including a blinded user device identifier and encrypted user device data;

using the blinded user device identifier to identify a shared secret stored in association with the blinded user device identifier, the storing of the stored shared secret occurring before the receiving of the message;

decrypting the encrypted user device data using the stored shared secret to obtain user device data;

determining a user device public key from a user device certificate, the user device data including the user device certificate and a first cryptographic nonce;

generating the blinded user device identifier based on the user device public key and the first cryptographic nonce;

verifying that the blinded user device identifier generated based on the user device public key and the first cryptographic nonce is the same as the blinded user device identifier included in the message from the user device; and

authenticating the user device based on the verifying of the blinded user device identifier.

2. The access device of claim 1, wherein the method further comprises:

generating a session key based on a key derivation function, the stored shared secret, and the blinded user device identifier, wherein the decrypting of the encrypted user device data using the stored shared secret is accomplished by using the session key generated based on the stored shared secret.

3. The access device of claim 1, wherein the method further comprises:

generating a second shared secret and a second cryptographic nonce, the generating of the second shared secret and the second cryptograph nonce based on a key derivation function and the stored shared secret;

generating a second blinded user device identifier based on the second cryptographic nonce and a user device public key or the blinded user device identifier, wherein the user device data optionally includes the user device public key when the user device public key is used; and

storing the second shared secret in association with the second blinded user device identifier for use in decrypting a next message from the user device.

4. The access device of claim 3, wherein the method further comprises:

generating an access device public key, wherein the generating of the second shared secret and the second cryptographic nonce is further based on the access device public key.

5. The access device of claim 3, wherein the user device data includes protocol control information, wherein the method further comprises:

determining that the protocol control information indicates to store the second shared secret, wherein the generating of the second blinded user device identifier and the storing of the second shared secret occur in response to the determining that the protocol control information indicates to store the second shared secret.

6. The access device of claim 1, wherein the user device data includes a user device certificate, wherein the method further comprises:

verifying the user device certificate using a signature of the user device certificate; and

authenticating the user device based on the verifying of the user device certificate.

7. A method for communicating, comprising:

receiving, from a user device, a message including a blinded user device identifier and encrypted user device data;

using the blinded user device identifier to identify a shared secret stored in association with the blinded user device identifier, the storing of the stored shared secret occurring before the receiving of the message;

decrypting the encrypted user device data using the stored shared secret to obtain user device data;

determining a user device public key from a user device certificate, the user device data including the user device certificate and a first cryptographic nonce;

generating the blinded user device identifier based on the user device public key and the first cryptographic nonce

verifying that the blinded user device identifier generated based on the user device public key and the first cryptographic nonce is the same as the blinded user device identifier included in the message from the user device; and

authenticating the user device based on the verifying of the blinded user device identifier.

8. The method of claim 7, further comprising:

generating a session key based on a key derivation function, the stored shared secret, and the blinded user device identifier, wherein the decrypting of the encrypted user device data using the stored shared secret is accomplished by using the session key generated based on the stored shared secret.

9. The method of claim 7, further comprising:

generating a second shared secret and a second cryptographic nonce, the generating of the second shared secret and the second cryptograph nonce based on a key derivation function and the stored shared secret;

generating a second blinded user device identifier based on the second cryptographic nonce and a user device public key or the blinded user device identifier, wherein the user device data optionally includes the user device public key when the user device public key is used; and

storing the second shared secret in association with the second blinded user device identifier for use in decrypting a next message from the user device.

10. The method of claim 9, wherein the user device data includes protocol control information, wherein the method further comprises:

determining that the protocol control information indicates to store the second shared secret, wherein the generating of the second blinded user device identifier and the storing of the second shared secret occur in response to the determining that the protocol control information indicates to store the second shared secret.

11. The method of claim 9, further comprising:

generating an access device public key, wherein the generating of the second shared secret and the second cryptographic nonce is further based on the access device public key.

12. The method of claim 7, wherein the method further comprises:

verifying the user device certificate using a signature of the user device certificate, wherein the authenticating of the user device is further based on the verifying of the user device certificate.

13. A user device, comprising:

a processor; and

a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising;

receiving, from an access device, a request message including an access device identifier;

identifying a stored shared secret associated with the access device identifier, the stored shared secret generated based on an access device public key, a user device private key, and a first cryptographic nonce;

encrypting user device data using the stored shared secret to obtain encrypted user device data;

sending, to the access device, a response message including a blinded user device identifier and the encrypted user device data, wherein the blinded user device identifier is generated from a user device public key associated with the user device private key and the first cryptographic nonce;

generating a second shared secret and a second cryptographic nonce, wherein generating the second shared secret is based on a key derivation function, the stored shared secret, the access device identifier, and the blinded user device identifier;

generating a second blinded user device identifier based on the second cryptographic nonce and the user device public key; and

storing the second shared secret in association with and the second blinded user device identifier for use in decrypting a next message from the user device.

14. The user device of claim 13, wherein the method further comprises:

identifying the blinded user device public key stored in association with the access device identifier; and

determining the blinded user device identifier using the stored blinded user device public key.

15. The user device of claim 13, wherein the method further comprises:

generating a session key based on a key derivation function, the stored shared secret, the access device identifier, and the blinded user device identifier, wherein the encrypting of the user device data further uses the session key.

16. The user device of claim 13, wherein the user device data includes a user device certificate, thereby allowing the access device to authenticate the user device based on a signature of the user device certificate.

17. The user device of claim 13, wherein the user device data includes a user device public key and a first cryptographic nonce, thereby allowing the access device to verify the blinded user device identifier by generating the blinded user device identifier based on the user device public key and the first cryptographic nonce.

18. An access device, comprising:

a processor; and

a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising;

sending, to a user device, a request message including an access device identifier;

receiving, from the user device, a response message including a blinded user device identifier and encrypted user device data;

using the blinded user device identifier to identify a shared secret stored in association with the blinded user device identifier, the storing of the stored shared secret occurring before the receiving of the message;

decrypting the encrypted user device data using the stored shared secret to obtain user device data;

generating a second shared secret and a second cryptographic nonce, the generating of the second shared secret and the second cryptograph nonce based on a key derivation function and the stored shared secret;

generating a second blinded user device identifier based on the second cryptographic nonce and a user device public key or the blinded user device identifier, wherein the user device data optionally includes the user device public key when the user device public key is used; and

storing the second shared secret in association with the second blinded user device identifier for use in decrypting a next message from the user device.

19. The access device of claim 18, wherein the method further comprises:

generating a session key based on a key derivation function, the stored shared secret, and the blinded user device identifier, wherein the decrypting of the encrypted user device data using the stored shared secret is accomplished by using the session key generated based on the stored shared secret.

20. The access device of claim 18, wherein the method further comprises:

generating an access device public key, wherein the generating of the second shared secret and the second cryptographic nonce is further based on the access device public key.

21. The access device of claim 18, wherein the user device data includes protocol control information, wherein the method further comprises:

determining that the protocol control information indicates to store the second shared secret, wherein the generating of the second blinded user device identifier and the storing of the second shared secret occur in response to the determining that the protocol control information indicates to store the second shared secret.

22. A method for communicating, comprising:

sending, to a user device, a request message including an access device identifier

receiving, from the user device, a response message including a blinded user device identifier and encrypted user device data;

using the blinded user device identifier to identify a shared secret stored in association with the blinded user device identifier, the storing of the stored shared secret occurring before the receiving of the message;

decrypting the encrypted user device data using the stored shared secret to obtain user device data;

generating a second shared secret and a second cryptographic nonce, the generating of the second shared secret and the second cryptograph nonce based on a key derivation function and the stored shared secret;

generating a second blinded user device identifier based on the second cryptographic nonce and a user device public key or the blinded user device identifier, wherein the user device data optionally includes the user device public key when the user device public key is used; and

storing the second shared secret in association with the second blinded user device identifier for use in decrypting a next message from the user device.

23. The method of claim 22, further comprising:

generating a session key based on a key derivation function, the stored shared secret, and the blinded user device identifier, wherein the decrypting of the encrypted user device data using the stored shared secret is accomplished by using the session key generated based on the stored shared secret.

24. The method of claim 22, further comprising:

generating an access device public key, wherein the generating of the second shared secret and the second cryptographic nonce is further based on the access device public key.

25. The method of claim 24, wherein the user device data includes protocol control information, wherein the method further comprises:

determining that the protocol control information indicates to store the second shared secret, wherein the generating of the second blinded user device identifier and the storing of the second shared secret occur in response to the determining that the protocol control information indicates to store the second shared secret.

26. A user device, comprising:

a processor; and

a non-transitory computer-readable storage medium comprising code executable by the processor for implementing a method comprising;

receiving, from an access device, a request message including an access device identifier;

identifying a stored shared secret associated with the access device identifier, the stored shared secret generated based on an access device public key, a user device private key, and a first cryptographic nonce;

encrypting user device data using the stored shared secret to obtain encrypted user device data, the user device data including a user device certificate and a first cryptographic nonce, the user device certificate including a user device public key; and

sending, to the access device, a response message including a blinded user device identifier and the encrypted user device data, wherein the blinded user device identifier is generated from a user device public key associated with the user device private key and the first cryptographic nonce, the user device data allowing the access device to generate the blinded user device identifier based on the user device public key and the first cryptographic nonce, verify that the blinded user device identifier generated based on the user device public key and the first cryptographic nonce matches the blinded user device identifier included in the response message, and authenticate the user device based on the verifying of the blinded user device identifier.

27. The user device of claim 26, wherein the method further comprises:

identifying the blinded user device public key stored in association with the access device identifier; and

determining the blinded user device identifier using the stored blinded user device public key.

28. The user device of claim 26, wherein the method further comprises:

generating a session key based on a key derivation function, the stored shared secret, the access device identifier, and the blinded user device identifier, wherein the encrypting of the user device data further uses the session key.

29. The user device of claim 26, wherein the user device data includes a user device public key and a first cryptographic nonce, thereby allowing the access device to verify the blinded user device identifier by generating the blinded user device identifier based on the user device public key and the first cryptographic nonce.