Methods for secure cryptogram generation

• US 10,389,533 B2
• Filed: 10/02/2017
• Issued: 08/20/2019
• Est. Priority Date: 08/29/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Le Saint, Eric, Gordon, James, Joshi, Roopesh
• Primary Examiner(s): Shehni, Ghazal B
• Application Number:
  US15/723,001
• Publication Number:
  US 20180026787A1
• Time in Patent Office: 687 Days
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

Embodiments of the invention introduce efficient methods for securely generating a cryptogram by a user device, and validating the cryptogram by a server computer. A secure communication can be conducted whereby a user device provides a cryptogram without requiring the user device to persistently store an encryption key or other sensitive data used to generate the cryptogram. The user device and server computer can mutually authenticate and establish a shared secret. Using the shared secret, the server computer can derive a session key and transmit key derivation parameters encrypted using the session key to the user device. The user device can derive the session key using the shared secret, decrypt the encrypted key derivation parameters, and store the key derivation parameters. Key derivation parameters and the shared secret can be used to generate a single use cryptogram key, which can be used to generate a cryptogram for conducting secure communications.

Claims

1. A computer-implemented method comprising:

determining, by a user device, a key pair comprising a public key and a private key;

sending, by the user device, a provisioning request message including the public key to a server computer;

receiving, by the user device, a provisioning response message including an encrypted credential from the server computer;

determining, by the user device, a response shared secret using the private key and a static server public key;

decrypting, by the user device, the encrypted credential using the response shared secret to determine a credential;

obtaining a key derivation parameter from the credential;

determining a first cryptogram key using the key derivation parameter;

generating a first cryptogram using the first cryptogram key; and

sending the first cryptogram to a second computer.

2. The computer-implemented method of claim 1, wherein the key derivation parameter is a limited use key.

3. The computer-implemented method of claim 2, wherein the determining of the first cryptogram key includes deriving, by the user device, the first cryptogram key using the limited use key and a key derivation function.

4. The computer-implemented method of claim 1, wherein the public key is an ephemeral public key, and wherein the private key is an ephemeral private key.

5. The computer-implemented method of claim 1, wherein the determining of the first cryptogram key further uses the response shared secret in addition to the key derivation parameter.

6. The computer-implemented method of claim 1,

wherein the first cryptogram is for use in a first secure communication with the second computer that validates the first cryptogram.

7. The computer-implemented method of claim 1, further comprising:

generating, by the user device, a request shared secret using the private key and the static server public key; and

encrypting, by the user device, request data using the request shared secret to obtain encrypted request data, wherein the provisioning request message includes the encrypted request data.

8. The computer-implemented method of claim 1, wherein the response shared secret is determined using a blinded key that is derived from the static server public key, thereby using the static server public key to determine the response shared secret, and wherein the provisioning response message also includes the blinded key.

9. The computer-implemented method of claim 1, wherein the response shared secret is determined without a blinded key, wherein the credential includes a cryptographic nonce, and wherein the first cryptogram key is further derived using the cryptographic nonce.

10. The computer-implemented method of claim 1, further comprising:

updating, by the user device, the response shared secret to determine an updated shared secret using an update parameter, the credential including the update parameter;

determining, by the user device, a second cryptogram key using the updated shared secret and the key derivation parameter;

generating, by the user device, a second cryptogram using the second cryptogram key; and

conducting, by the user device, a second secure communication with a validation computer using the second cryptogram.

11. The computer-implemented method of claim 10, further comprising:

generating, by the user device, new shared secrets for each of a plurality of new secure communications, each new shared secret generated using a previous shared secret and the update parameter;

determining, by the user device, new cryptogram keys using the new shared secrets and the key derivation parameter;

generating, by the user device, new cryptograms using the new cryptogram key; and

conducting, by the user device, the new secure communications with the validation computer using the new cryptograms.

12. The computer-implemented method of claim 10, wherein the second cryptogram is further generated using data based on cryptogram derivation parameters included in the credential, and wherein the second secure communication is an authorization request, wherein the second cryptogram authenticates at least one element of the authorization request.

13. The computer-implemented method of claim 1, further comprising:

receiving, by the user device, first registration data;

encrypting, by the user device, the first registration data using the first cryptogram key to generate the first cryptogram, the first cryptogram being a registration cryptogram;

storing, by the user device, the response shared secret;

encrypting, by the user device, the registration cryptogram using the response shared secret; and

sending, by the user device, the registration cryptogram to the second computer that is a registration server computer, wherein the registration server computer authenticates the user device using the registration cryptogram.

14. The computer-implemented method of claim 1, wherein the second computer is the server computer.

15. A computer-implemented method, comprising:

receiving, by a server computer, a provisioning request message from a user device, the provisioning request message including a device public key;

determining, by the server computer, a request shared secret using the device public key and a static server private key;

generating, by the server computer, a response shared secret using the static server private key and the device public key;

obtaining a key derivation parameter for determining a first cryptogram key from the response shared secret;

encrypting, by the server computer, a credential using the response shared secret to determine encrypted response data, the credential including the key derivation parameter; and

sending, by the server computer, to the user device, a provisioning response message including the encrypted response data.

16. The computer-implemented method of claim 15, further comprising:

receiving, by the server computer from the user device, a user cryptogram for validating a secure communication;

determining the first cryptogram key using the key derivation parameter;

generating a first cryptogram using the first cryptogram key and a cryptogram derivation parameter, the credential including the cryptogram derivation parameter; and

validating, by the server computer, the user cryptogram by comparing the user cryptogram to the first cryptogram.

17. The computer-implemented method of claim 16, further comprising:

updating, by the server computer, the response shared secret to determine an updated shared secret;

receiving, by the server computer from the user device, a new cryptogram for validating a new secure communication;

determining a second cryptogram key from the updated shared secret using the key derivation parameter;

generating a second cryptogram using the second cryptogram key and the cryptogram derivation parameter; and

validating, by the server computer, the new cryptogram by comparing the new cryptogram to the second cryptogram.

18. The computer-implemented method of claim 15, further comprising:

providing, by the server computer, first registration data to the user device;

receiving, by the server computer, a user registration cryptogram from the user device;

determining the first cryptogram key using the key derivation parameter;

encrypting, by the server computer, the first registration data using the first cryptogram key to generate a first registration cryptogram; and

verifying, by the server computer, the user registration cryptogram by comparing the user registration cryptogram to the first registration cryptogram, wherein the user device is authenticated if the first registration cryptogram is verified.

19. The computer-implemented method of claim 18, wherein the first registration data includes a one-time password, and wherein the user registration cryptogram is based on the one-time password.

20. A computer system, comprising:

a memory that stores computer-executable instructions; and

a processor configured to access the memory and execute the computer-executable instructions to;

determine an key pair comprising a public key and a private key;

send a provisioning request message including the public key to a server computer;

receive a provisioning response message including an encrypted credential from the server computer;

determine a response shared secret using the private key and a static server public key;

decrypt the encrypted credential using the response shared secret to determine a credential;

obtain a key derivation parameter from the credential;

determine a first cryptogram key using the key derivation parameter;

generate a first cryptogram using the first cryptogram key; and

send the first cryptogram to a second computer.

21. The computer system of claim 20, wherein the key derivation parameter is a limited use key.

22. The computer system of claim 20, wherein the determining of the first cryptogram key further uses the response shared secret in addition to the key derivation parameter.

23. The computer system of claim 20, wherein the processor is further configured to access the memory and execute the computer-executable instructions to:

generate a request shared secret using the private key and the static server public key; and

encrypt request data using the request shared secret to obtain encrypted request data.

24. The computer system of claim 20, wherein the response shared secret is determined using a blinded key that is derived from the static server public key, thereby using the static server public key to determine the response shared secret, and wherein the provisioning response message also includes the blinded key.

25. The computer system of claim 20, wherein the response shared secret is determined without a blinded key, wherein the credential includes a cryptographic nonce, and wherein the first cryptogram key is further derived using the cryptographic nonce.

26. The computer system of claim 20, wherein the processor is further configured to access the memory and execute the computer-executable instructions to:

update the response shared secret to determine an updated shared secret using an update parameter, the credential including the update parameter;

determine a second cryptogram key using the updated shared secret and the key derivation parameter;

generate a second cryptogram using the second cryptogram key; and

conduct a second secure communication with a validation computer using the second cryptogram.

27. The computer system of claim 20, wherein the processor is further configured to access the memory and execute the computer-executable instructions to:

receive first registration data;

encrypt the first registration data using the first cryptogram key to generate the first cryptogram, the first cryptogram being a registration cryptogram;

store the response shared secret;

encrypt the registration cryptogram using the response shared secret; and

send the registration cryptogram to the second computer that is a registration server computer, wherein the registration server computer authenticates the computer system using the registration cryptogram.

28. A server computer comprising:

a memory that stores computer-executable instructions; and

a processor configured to access the memory and execute the computer-executable instructions to;

receive a provisioning request message from a user device, the provisioning request message including a device public key;

determine a request shared secret using the device public key and a static server private key;

generate a response shared secret using the static server private key and the device public key;

obtain a key derivation parameter for determining a first cryptogram key from the response shared secret;

encrypt a credential using the response shared secret to determine encrypted response data, the credential including the key derivation parameter; and

send to the user device a provisioning response message including the encrypted response data.

29. The server computer of claim 28, wherein the processor is further configured to access the memory and execute the computer-executable instructions to:

receive, from the user device, a user cryptogram for validating a secure communication;

determine the first cryptogram key using the key derivation parameter;

generate a first cryptogram using the first cryptogram key and a cryptogram derivation parameter, the credential including the cryptogram derivation parameter; and

validate the user cryptogram by comparing the user cryptogram to the first cryptogram.

30. The server computer of claim 29, wherein the processor is further configured to access the memory and execute the computer-executable instructions to:

update the response shared secret to determine an updated shared secret;

receive, from the user device, a new cryptogram for validating a new secure communication;

determining a second cryptogram key from the updated shared secret using the key derivation parameter;

generating a second cryptogram using the second cryptogram key and the cryptogram derivation parameter; and

validate the new cryptogram by comparing the new cryptogram to the second cryptogram.

31. The server computer of claim 28, wherein the processor is further configured to access the memory and execute the computer-executable instructions to:

providing, by the server computer, first registration data to the user device;

receiving, by the server computer, a user registration cryptogram from the user device;

determining the first cryptogram key using the key derivation parameter;

encrypting, by the server computer, the first registration data using the first cryptogram key to generate a first registration cryptogram; and

verifying, by the server computer, the user registration cryptogram by comparing the user registration cryptogram to the first registration cryptogram, wherein the user device is authenticated if the first registration cryptogram is verified.

32. The server computer of claim 31, wherein the first registration data includes a one-time password, and wherein the user registration cryptogram is based on the one-time password.