Client device authentication using contactless legacy magnetic stripe data

• US 10,701,560 B1
• Filed: 10/02/2019
• Issued: 06/30/2020
• Est. Priority Date: 10/02/2019
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Lerner, Evan, Mossler, Lara
• Primary Examiner(s): Potratz, Daniel B
• Application Number:
  US16/590,536
• Time in Patent Office: 272 Days
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/4093 Monitoring of device authentication
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G06V 40/10 Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
• CPC Class Codes: G06V 40/1365 Matching; Classification
• CPC Class Codes: G06V 40/172 Classification, e.g. identification
• CPC Class Codes: G06V 40/55 Performing matching on a personal external card, e.g. to avoid submitting reference information
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/0893 the card reader reading the card in a contactless manner
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0866 : involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0877 : using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 : involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04M 1/0202 : Portable telephone sets, e.g. cordless phones, mobile phones or bar type handsets constructional features of telephone transmitters or receivers, e.g. of speakers or microphones H04M1/03
• CPC Class Codes: H04W 12/03 : Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/041 : Key generation or derivation
• CPC Class Codes: H04W 12/06 : Authentication

Abstract

A technique for generating a diversified encryption key for a contactless legacy magnetic stripe card is disclosed. The diversified key can be generated using a master key, a key diversification value and an encryption algorithm. In one example embodiment, the key diversification value can be provided by the user as a fingerprint, numeric code or photo. The user can provide the key diversification value to the card or a cellphone. The card can generate the diversified key using the user provided key diversification value. The card or the cellphone can transmit the user provided diversification value to the server and the server can regenerate the diversified key using the user provided diversification value.

Claims

1. A data transmission system comprising:

a card having a processor and memory, the memory of the card containing a master key, transmission data and a counter value, wherein the card is an MSD compliant card;

a server having a processor and memory, the memory of the server containing the master key and the counter value;

a cellphone wherein the server is in data communication with the card through the cellphone;

wherein the cellphone is configured to;

receive an input from a user and, based on the input, derive a key diversification value;

transmit the key diversification value to the card;

receive encrypted transmission data from the card; and

transmit the encrypted transmission data and the key diversification value to the server;

wherein the card is configured to;

generate a diversified key using the master key, the counter value, the key diversification value and one or more cryptographic algorithms;

encrypt the transmission data using one or more cryptographic algorithms and the diversified key to yield the encrypted transmission data, and

transmit the encrypted transmission data to the cellphone; and

wherein the server is configured to;

receive the encrypted transmission and the key diversification value from the cellphone;

generate the diversified key based on the master key, the counter value and the key diversification value; and

decrypt the encrypted transmission data using one or more cryptographic algorithms and the diversified key; and

transmit a communication to a second server to authenticate a transaction.

2. The data transmission system of claim 1, wherein the card is a contactless card in compliance with the following standards:

ISO/IEC 7810, ISO/IEC 7811, ISO/IEC 7812, ISO/IEC 7813, ISO 8583, and ISO/IEC 4909.

3. The data transmission system of claim 1, wherein the transmission data includes an account number.

4. The data transmission system of claim 1, wherein the input is an alphanumeric code provided by the user through a touchscreen of the cellphone.

5. The data transmission system of claim 1, wherein the input is a fingerprint scanned at the cellphone.

6. The data transmission system of claim 5, wherein the cellphone stores a plurality of key diversification values in association with a plurality of fingerprints.

7. The data transmission system of claim 6, wherein the cellphone is configured to transmit to the card and the server the key diversification value associated with the fingerprint scanned at the cellphone.

8. The data transmission system of claim 1, wherein the input is a photo of the user.

9. The data transmission system of claim 8, wherein the cellphone is configured to transmit the photo to the server.

10. The data transmission system of claim 9, wherein the server is configured to conduct a facial recognition technique to match the photo to a photo of the user stored in the server.

11. The data transmission system of claim 10, wherein the server is configured to generate the key diversification value based on the photo.

12. The data transmission system of claim 11, wherein the server is configured to transmit the key diversification value to the cellphone.

13. A data transmission system comprising:

a card having a processor and memory, the memory of the card containing a master key, transmission data and a counter value, wherein the card is an MSD compliant card;

a server having a processor and memory, the memory of the server containing the master key and the counter value;

a cellphone wherein the server is in data communication with the card through the cellphone;

wherein the cellphone is configured to;

receive a first input from a user and, based on the first input, derive a key diversification value;

receive a second input from the user and, based on the second input, derive an algorithm selection value;

transmit the key diversification value and the algorithm selection value to the card;

receive encrypted transmission data from the card; and

transmit the encrypted transmission data, the key diversification value and the algorithm selection value to the server;

wherein the card is configured to;

generate a diversified key using the master key, the counter value, the key diversification value and a cryptographic algorithm selected using the algorithm selection value;

encrypt the transmission data using the cryptographic algorithm and the diversified key to yield the encrypted transmission data; and

transmit the encrypted transmission data to the cellphone; and

wherein the server is configured to;

receive the encrypted transmission, the key diversification value and the algorithm selection value from the cellphone;

generate the diversified key based on the master key, the counter value and the key diversification value using the cryptographic algorithm; and

decrypt the encrypted transmission data using the cryptographic algorithm and the diversified key; and

transmit a communication to a second server to authenticate a transaction.

14. The data transmission system of claim 13, wherein the card is a contactless card in compliance with the following standards:

ISO/IEC 7810, ISO/IEC 7811, ISO/IEC 7812, ISO/IEC 7813, ISO 8583, and ISO/IEC 4909.

15. The data transmission system of claim 13, wherein the first input is a fingerprint scanned at the cellphone and the second input is an alphanumeric value entered on a touchscreen of the cellphone.

16. The data transmission system of claim 15, wherein the cellphone stores a plurality of key diversification values in association with a plurality of fingerprints.

17. The data transmission system of claim 16, wherein the cellphone is configured to transmit to the card and the server:

the key diversification value associated with the fingerprint scanned at the cellphone; and

the alphanumeric value as the algorithm selection value.

18. The data transmission system of claim 13, wherein the first input is a photo of the user.

19. The data transmission system of claim 18, wherein the cellphone is configured to transmit the photo to the server.

20. The data transmission system of claim 19, wherein the server is configured to generate the key diversification value based on the photo.