Systems and methods for inventory management using cryptographic authentication of contactless cards

• US 10,680,824 B2
• Filed: 10/01/2019
• Issued: 06/09/2020
• Est. Priority Date: 10/02/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Rule, Jeffrey, Newman, Kaitlin, Ilincic, Rajko
• Primary Examiner(s): Tran, Ellen
• Application Number:
  US16/590,051
• Publication Number:
  US 20200106616A1
• Time in Patent Office: 252 Days
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/77 in smart cards
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/202 Interconnection or interaction of plural electronic cash registers [ECR] or to host computer, e.g. network details, transfer of information from host to ECR or from ECR to ECR
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices for use in a tap and walk store are provided. In an example embodiment, the transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key. Disclosed systems allow a user to purchase items utilizing the disclosed transmitting device.

Claims

1. A data transmission system comprising:

a contactless card comprising a processor, a memory containing an applet and a product list, and a contactless communication interface;

an authentication server in data communication with one or more inventory management devices, each inventory management device comprising a processor and a contactless communication interface configured to generate a contactless communication field wherein, after entry of the contactless card into the contactless communication field of the inventory management device, the inventory management device is configured to;

request an identification token from the applet;

generate an identification message based on the identification token;

transmit the identification message to the authentication server for authentication;

receive an authentication message from the authentication server, the authentication message based on the authentication; and

transmit a product message to the contactless card, wherein upon receipt of the product message, the contactless card updates the product list based on the received product message; and

a contactless point of sale device comprising a processor and a contactless communication interface, wherein, after entry of the contactless card into the contactless communication field of the point of sale device, the point of sale device is configured to;

request the product list from the contactless card;

receive a product list message from the contactless card; and

execute an operation based on the product list message.

2. The data transmission system of claim 1, the inventory management device transmits, upon receiving the authentication message from the authentication server, an authorization token to the contactless card.

3. The data transmission system of claim 2, wherein

the inventory management device is further configured to transmit a product message to the contactless card upon receipt of the authorization token from the contactless card, and

the contactless card is configured to selectively transmit the authentication token in response to a request for the identification token from the inventory management device.

4. The data transmission system of claim 2, wherein the authorization token is valid for a predetermined period of time.

5. The data transmission system of claim 1, wherein

the inventory management device is further configured to:

detect a gesture of the contactless card within the contactless communication field of the inventory management device, and

transmit, after detecting the gesture, a product removal message to the contactless card, wherein upon receipt of the product removal message, the contactless card updates the product list based on the received product removal message.

6. The data transmission system of claim 1, further comprising a weight sensor in data communication with the point of sale device, the weight sensor configured to weigh one or more retail products and transmit a product weight message to the point of sale device, the product weight message including a measured product weight;

the point of sale device configured to determine an anticipated product weight based on the product list message received from the contactless card and compare the anticipated product weight with the measured product weight.

7. The data transmission system of claim 6, wherein the point of sale device is configured to determine a difference between the anticipated product weight and the measured product weight and pause prior to executing the operation if the difference is outside of a predetermined range.

8. The data transmission system of claim 1, wherein the product list includes information associated with a price of a retail product.

9. The data transmission system of claim 1, further comprising a secondary device in data communication with the contactless card, the secondary device configured to receive information associated with the product list from the contactless card and display at least a portion of the received information associated with the product list on a user interface.

10. The data transmission system of claim 9, wherein the secondary device is configured to transmit a product revision message to the contactless card based on user input received by the user interface, and wherein the contactless card is configured to modify the product list in response to the received product revision message.

11. The data transmission system of claim 9, wherein the user interface is configured to display promotional material in response to the received information associated with the product list received from the contactless card.

12. The data transmission system of claim 1, wherein the point of sale device is further configured to transmit a notification containing a passcode to a mobile device associated with the contactless card upon receiving a product list message from the contactless card, and request the passcode from a user prior to executing the operation.

13. The data transmission system of claim 1, wherein the point of sale device comprises a mobile device.

14. The data transmission system of claim 1, further comprising an inventory server configured to monitor inventory of a retail store, the inventory server in data communication with the inventory management device wherein, upon transmitting a product message to the contactless card, the inventory management device transmits an inventory message to the inventory server.

15. A method of transmitting data product comprising:

requesting, after entry of a transmitting device into a contactless communication field of a receiving device in data communication with an authorization server, an identification token from an applet, the transmitting device comprising a processor, a memory containing the applet and a product list, and a contactless communication interface, the receiving device comprising a processor and a contactless communication interface configured to generated the contactless communication field;

generating an identification message based on the identification token; and

transmitting the identification message to the authentication server for authentication;

receiving an authentication message from the authentication server, the authentication message based on the authentication;

transmitting a product message to the transmitting device;

updating the product list based on the received product message;

requesting, after entry of the transmitting device into a contactless communication field of a point of sale device, a product list message from the transmitting device, the contactless point of sale device comprising a processor and a contactless communication interface;

receiving a product list message from the transmitting device; and

executing an operation based on the product list message.

16. The method of claim 15, further comprising:

transmitting an authorization token to the transmitting device; and

requesting the authorization token prior to transmitting the product message to the transmitting device.

17. The method of claim 15, further comprising:

transmitting authentication message to a retail server in data communication with the receiving device;

transmitting an approval message to the receiving device; and

transmitting, upon receiving the approval message, an authorization token to the transmitting device.

18. The method of claim 15, further comprising,

encrypting the identification token;

and

transmitting the encrypted identification token to the receiving device.

19. The method of claim 15, further comprising:

transmitting, upon receiving a product list message from the transmitting device, a passcode to a mobile device associated with the transmitting device; and

requesting the passcode from a user prior to executing the operation.

20. A checkout system comprising:

a transmitting device comprising a processor, a memory containing an applet and a product list, and a contactless communication interface;

a receiving device comprising a processor, and a contactless communication interface configured to generate a near field communication field;

a remote authentication server in data communication with the receiving device, wherein after entry of the transmitting device into the near field communication field of the receiving device, the receiving device is configured to;

request an identification token;

generate, upon receiving the identification token, an identification message based on the identification token;

transmit the identification message to the remote authentication server;

receive an authentication message from the remote authentication server;

generate an authorization token based on the authentication message; and

transmit the authorization token to the transmitting device; and

an inventory management device comprising a processor, and a contactless communication interface configured to generate a near field communication field, the inventory management device configured to;

request the authorization token from the transmitting device, and

transmit, upon receipt of the authorization token from the transmitting device, a product message to the transmitting device; and

a point of sale device comprising a processor and a contactless communication interface configured to generate a near field communication field, the point of sale device in data communication with a weight sensor, the weight sensor configured to;

determine a weight of one or more retail products; and

transmit a product weight message to the point of sale, the product weight message including a measured product weight;

the point of sale device configured to, after entry of the transmitting device into the near field communication field of the point of sale device;

request a product list message from the transmitting device;

receive the product list message from the transmitting device;

request a product weight message from the weight sensor;

receive the product weight message from the weight sensor;

determine an anticipated product weight based on the product list message received from the transmitting device;

determine a difference between the anticipated product weight and the measured product weight; and

execute, upon determining the difference between the anticipated product weight and the measured product weight is less than a predetermined amount, an operation.