ANYTIME VALIDATION FOR VERIFICATION TOKENS

• US 20110173684A1
• Filed: 01/12/2011
• Published: 07/14/2011
• Est. Priority Date: 01/12/2010
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Hammad, Ayman, Hurry, Simon
• Granted Patent: US 8,528,067 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06Q 20/355 Personalisation of cards for use
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3829 involving key management

Abstract

Systems and method for producing, validating, and registering authentic verification tokens are disclosed. Such systems and methods include generating verification token specific key pairs. The key pairs can be signed by a verification token manufacturer master key or public key certificate for an additional level of authenticity. Related methods and systems for authenticating and registering authorized verification token manufacturers are also disclosed. Once a verification token manufacturer is authenticated, it can be assigned a manufacturer-specific key pair or certificate and in some cases, a predetermined set of serial numbers to assign to the verification tokens it produces. Each serial number can be used to generate a verification token specific key pair specific to the associated verification token. One component of the verification token key pair can be stored to the verification token. Optionally, the component of the verification token key pair stored to the verification token can be signed by the manufacturer specific master key or certificate and stored a verification token public certificate.

Claims

1. A method comprising:

receiving a registration request from a verification token manufacturer at a server computer;

retrieving information related to the verification token manufacturer using the server computer; and

generating a manufacturer specific key pair using the server computer.

2. The method of claim 1 further comprising performing a risk review based on the information related to the verification token manufacturer using the server computer.

3. The method of claim 1 further comprising:

assigning the manufacturer specific key pair to the verification token manufacturer using the server computer; and

generating a verification token manufacturer key certificate based on the manufacturer specific key pair using the server computer.

4. The method of claim 3 wherein the manufacturer specific key pair comprises a public and a private component.

5. The method of claim 4 further comprising:

signing the public component of the manufacturer specific key pair with a master authentication certificate using the server computer; and

sending the signed component of the manufacturer specific key pair and the verification token manufacturer key certificate to the verification token manufacturer.

6. The method of claim 1 further comprising:

associating the manufacturer specific key pair, the verification token manufacturer public key certificate and the signed public component of the manufacturer specific key pair with a verification token manufacturer identifier using the server computer; and

storing the associated reader-device manufacturer identifier in a database.

7. A method comprising:

receiving an validation request from a verification token at a server; and

determining a verification token serial number based on the validation request using the server; and

determining a registration status of the verification token serial number.

8. The method of claim 7 further comprising determining a verification token specific key pair comprising a public component and a private component based on the serial number.

9. The of claim 8 further comprising signing a challenge message with the private component and sending it to the verification token.

10. The method of claim 9 further comprising determining a verification token manufacturer identifier based on the validation request and determining a first component of a manufacturer specific key pair based on the verification token manufacturer identifier using the server and singing the challenge message with the first component of a manufacturer specific key pair.

11. The method of claim 10 further comprising retrieving a second component of the manufacturer specific key and a verification token manufacturer master key from a database based on the device manufacturer identifier using the server;

and

performing a mutual authentication with the verification token using the server.

12. The method of claim 11 wherein performing the mutual authentication comprises:

determining a verification token key based on the verification token serial number and the verification token manufacturer master key; and

establishing a verification token key session based on the verification token key.

13. The method of claim 12 wherein establishing a verification token key session further comprises:

generating a third component of the manufacturer specific key based on the verification token serial number and a master key associated with the server computer.

14. A method comprising:

generating a serial number for a verification token;

generating a key pair including a public component and a private component;

storing the private component of the key pair to a memory in the verification token; and

associating the serial number with the key pair and the private component.

15. The method of claim 14 further comprising storing the serial number to the memory in the verification token.

16. The method of claim 15 further wherein generating the key pair comprises signing the public component of the key pair with a manufacturer specific master key to generate a verification token public certificate.

17. The method of claim 16 further comprising storing a manufacturer identifier to the memory of the verification token.

18. The method of claim 17 further comprising storing code executable on a processor to establish a connection with a verification server over a communication session using a communication facility of a computer to which the verification token is connected.

19. The method of claim 17 further comprising storing the verification token public certificate to the memory.