Systems and Methods for Authenticating Mobile Devices

• US 20120303961A1
• Filed: 05/25/2012
• Published: 11/29/2012
• Est. Priority Date: 05/26/2011
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Kean, Brian, Cambridge, Devin Michael, Meyers, Stephen M., Musfeldt, Roger Lynn, Adkisson, Brent Dewayne, Davis, Norman Theodore Jr.
• Granted Patent: US 8,880,886 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Embodiments of the invention provide systems and methods for authenticating mobile devices. A registration request and identifying information for a mobile device or a secure element associated with the mobile device may be received. Based upon the received identifying information and a base level key, a rotated key for the mobile device may be determined. The determined rotated key may then be provided to the mobile device, and the rotated key may be utilized for subsequent authentication of the mobile device.

Claims

1. A computer-implemented method for authenticating mobile devices, the method comprising:

receiving, from a mobile device, a registration request and identifying information for the mobile device or a secure element associated with the mobile device;

determining, based upon the received identifying information and a base level key, a rotated key for the mobile device; and

providing the determined rotated key to the mobile device;

wherein the rotated key is utilized for subsequent authentication of the mobile device, and

wherein the above operations are performed by one or more computers associated with a provisioning service provider.

2. The computer-implemented method of claim 1, further comprising:

establishing, prior to determining the rotated key, a secure communications channel with the mobile device secure element; and

authenticating, via the secure communications channel, the secure element.

3. The computer-implemented method of claim 1, wherein receiving identifying information comprises receiving card production life cycle (CPLC) information.

4. The computer-implemented method of claim 1, wherein determining a rotated key for the mobile device comprises generating a rotated key utilizing the identifying information and the base level key.

5. The computer-implemented method of claim 1, further comprising:

updating the identifying information; and

associating the rotated key with the updated identifying information.

6. The computer-implemented method of claim 5, wherein updating the identifying information comprises updating a card production life cycle (CPLC) for the mobile device or the secure element.

7. The computer-implemented method of claim 5, further comprising:

communicating the updated identifying information and information associated with the rotated key to a service provider for subsequent authentication of the mobile device.

8. The computer-implemented method of claim 7, further comprising:

receiving, from the service provider, a request to provision the mobile device; and

provisioning the mobile device in response to the received request,

wherein the request is received following an authentication of the mobile device by the service provider based at least in part upon the rotated key.

9. The computer-implemented method of claim 8, wherein the service provider authenticates the mobile device by reconstructing the rotated key utilizing the updated identifying information.

10. The computer-implemented method of claim 8, wherein provisioning the mobile device comprises provisioning the secure element of the mobile device with a financial account.

11. A system, comprising:

at least one memory operable to store computer-executable instructions; and

at least one processor configured to access the at least one memory and execute the computer-executable instructions to;

receive, from a mobile device, a registration request and identifying information for the mobile device or a secure element associated with the mobile device;

determine, based upon the received identifying information and a base level key, a rotated key for the device; and

provide the determined rotated key to the mobile device,

wherein the rotated key is utilized for subsequent authentication of the mobile device.

12. The system of claim 11, wherein the at least one processor is further configured to execute the computer-executable instructions to:

establish, prior to determining the rotated key, a secure communications channel with the mobile device secure element; and

authenticate, via the secure communications channel, the secure element.

13. The system of claim 11, wherein the received identifying information comprises card production life cycle (CPLC) information.

14. The system of claim 11, wherein the rotated key is generated utilizing at least a portion of the received identifying information and the base level key.

15. The system of claim 11, wherein the at least one processor is further configured to execute the computer-executable instructions to:

update the identifying information; and

associate the rotated key with the updated identifying information.

16. The system of claim 15, wherein the updated identifying information comprises an updated card production life cycle (CPLC) for the mobile device or the secure element.

17. The system of claim 15, wherein the at least one processor is further configured to execute the computer-executable instructions to:

direct communication of the updated identifying information and information associated with the rotated key to a service provider for subsequent authentication of the mobile device.

18. The system of claim 17, wherein the at least one processor is further configured to execute the computer-executable instructions to:

receive, from the service provider, a request to provision the mobile device; and

direct provisioning of the mobile device in response to the received request,

wherein the request is received following an authentication of the mobile device by the service provider based at least in part upon the rotated key.

19. The system of claim 18, wherein the service provider authenticates the mobile device by reconstructing the rotated key utilizing the updated identifying information.

20. The system of claim 18, wherein a financial account is provisioned to the secure element of the mobile device.