Methods for secure credential provisioning
First Claim
Patent Images
1. A computer-implemented method, comprising:
- determining, by a user device, a one-time user public key;
sending, by the user device to a provisioning server computer, a provisioning request message including the one-time user public key;
receiving, by the user device, an encrypted provisioning response message from the provisioning server computer, the encrypted provisioning response message comprising encrypted credential data;
determining, by the user device, a response shared secret using a static server public key;
determining, by the user device, a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message;
decrypting, by the user device, the encrypted provisioning response message using the response session key to determine the encrypted credential data;
determining, by the user device, a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data;
encrypting, by the user device, the storage protection key with a key encryption key to generate an encrypted storage protection key;
storing, by the user device, the encrypted storage protection key;
storing, by the user device, the encrypted credential data;
retrieving, by the user device, the encrypted credential data;
retrieving, by the user device, the encrypted storage protection key;
decrypting, by the user device, the encrypted storage protection key using the key encryption key to obtain the storage protection key; and
decrypting, by the user device, the encrypted credential data using the storage protection key to obtain credential data.
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments can provide methods for securely provisioning sensitive credential data, such as a limited use key (LUK) onto a user device. In some embodiments, the credential data can be encrypted using a separate storage protection key and decrypted only at the time of a transaction to generate a cryptogram for the transaction. Thus, end-to-end protection can be provided during the transit and storage of the credential data, limiting the exposure of the credential data only when the credential data is required, thereby reducing the risk of compromise of the credential data.
-
Citations
20 Claims
-
1. A computer-implemented method, comprising:
-
determining, by a user device, a one-time user public key; sending, by the user device to a provisioning server computer, a provisioning request message including the one-time user public key; receiving, by the user device, an encrypted provisioning response message from the provisioning server computer, the encrypted provisioning response message comprising encrypted credential data; determining, by the user device, a response shared secret using a static server public key; determining, by the user device, a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message; decrypting, by the user device, the encrypted provisioning response message using the response session key to determine the encrypted credential data; determining, by the user device, a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data; encrypting, by the user device, the storage protection key with a key encryption key to generate an encrypted storage protection key; storing, by the user device, the encrypted storage protection key; storing, by the user device, the encrypted credential data; retrieving, by the user device, the encrypted credential data; retrieving, by the user device, the encrypted storage protection key; decrypting, by the user device, the encrypted storage protection key using the key encryption key to obtain the storage protection key; and decrypting, by the user device, the encrypted credential data using the storage protection key to obtain credential data. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A computer-implemented method, comprising:
-
determining, by a user device, a one-time user public key; generating, by the user device, a request shared secret using a static server public key and a user private key corresponding to the one-time user public key; encrypting, by the user device, request data using the request shared secret to obtain encrypted request data; sending, by the user device to a provisioning server computer, a provisioning request message including the one-time user public key and the encrypted request data; receiving, by the user device, an encrypted provisioning response message from the provisioning server computer, the encrypted provisioning response message comprising encrypted credential data; determining, by the user device, a response shared secret using the static server public key; determining, by the user device, a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message; decrypting, by the user device, the encrypted provisioning response message using the response session key to determine the encrypted credential data; determining, by the user device, a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data; encrypting, by the user device, the storage protection key with a key encryption key to generate an encrypted storage protection key; storing, by the user device, the encrypted storage protection key; and storing, by the user device, the encrypted credential data. - View Dependent Claims (11, 12)
-
-
13. A computer system, comprising:
-
a memory that stores computer-executable instructions; and a processor configured to access the memory and execute the computer-executable instructions to; determine a one-time user public key; send, to a provisioning server computer, a provisioning request message including the one-time user public key; receive an encrypted provisioning response message from the provisioning server computer, the encrypted provisioning response message comprising encrypted credential data; determine a response shared secret using a static server public key; determine a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message; decrypt the encrypted provisioning response message using the response session key to determine the encrypted credential data; determine a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data; encrypt the storage protection key with a key encryption key to generate an encrypted storage protection key; store the encrypted storage protection key; store the encrypted credential data; retrieve the encrypted credential data; retrieve the encrypted storage protection key; decrypt the encrypted storage protection key using the key encryption key to obtain the storage protection key; and decrypt the encrypted credential data using the storage protection key to obtain credential data. - View Dependent Claims (14, 15, 16, 17)
-
-
18. A computer system, comprising:
-
a memory that stores computer-executable instructions; and a processor configured to access the memory and execute the computer-executable instructions to; determine a one-time user public key; generate a request shared secret using a static server public key and a user private key corresponding to the one-time user public key; encrypt request data using the request shared secret to obtain encrypted request data; send, to a provisioning server computer, a provisioning request message including the one-time user public key and the encrypted request data; receive an encrypted provisioning response message from the provisioning server computer, the encrypted provisioning response message comprising encrypted credential data; determine a response shared secret using the static server public key; determine a response session key from the response shared secret, the response session key usable for decrypting the encrypted provisioning response message; decrypt the encrypted provisioning response message using the response session key to determine the encrypted credential data; determine a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for decrypting the encrypted credential data; encrypt the storage protection key with a key encryption key to generate an encrypted storage protection key; store the encrypted storage protection key; and store the encrypted credential data. - View Dependent Claims (19, 20)
-
Specification