Credential recovery

• US 9,800,562 B2
• Filed: 12/04/2013
• Issued: 10/24/2017
• Est. Priority Date: 12/04/2012
• Status: Active Grant

• Current Assignee: Barclays Execution Services Ltd. (Barclays PLC)
• Original Assignee: Barclays Bank PLC (Barclays PLC)
• Inventors: Lalwani, Akhil, French, George
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Corum, Jr., William
• Application Number:
  US14/096,517
• Publication Number:
  US 20140156989A1
• Time in Patent Office: 1,420 Days
• Field of Search: 713155
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement

Abstract

In a credential recovery process, a user is authenticated using an application running on a mobile communications device, and requests recovery of a credential. The application generates a session key encrypted with the public key of a gateway, and sends the encrypted key to the gateway. The gateway recovers the credential from a depository, encrypted using a symmetric key shared with the depository. The gateway decrypts the credential and re-encrypts the credential using the session key. Preferably, the decryption and re-encryption is performed within a hardware secure module within the gateway. The re-encrypted credential is sent to the application, which decrypts the credential and outputs it to the user. In this way, the credential is provided securely to the user and may be made available for use immediately, or nearly so.

Claims

1. A method of credential recovery, comprising the steps of:

authenticating a user with a mobile application on a mobile communication device, by entry of a previously registered passcode;

receiving from the user an identification of a forgotten credential to be recovered using the mobile application;

requesting the identified credential from a mobile application server using the mobile application;

securely establishing a session key between the mobile application and the mobile application server;

recovering from a credential depository the credential in encrypted form, encrypted using an encryption key different from the session key and independent from any information received by the mobile application server from the mobile application;

decrypting the credential using said encryption key, and encrypting the credential using the session key, at the mobile application server;

providing the credential encrypted using the session key to the mobile application;

decrypting the credential encrypted using the session key at the mobile application to form a decrypted credential; and

displaying the decrypted credential to the user from the mobile application;

wherein securely establishing a session key comprises generating the session key, encrypting the session key using one of a public key and a private key corresponding to the public key to form an encrypted session key, sending the encrypted session key, and decrypting the encrypted session key using the other of the public key and the private key corresponding to the public key.

2. The method of claim 1, wherein the mobile application server decrypts the credential encrypted using the encryption key within a hardware security module.

3. The method of claim 2, including providing to the hardware security module an authentication code based on one or more elements of the credential request, wherein the hardware security module validates the authentication code and provides the credential encrypted using the session key only if the authentication code is valid.

4. The method of claim 1, wherein the step of encrypting the session key includes padding the session key prior to encryption.

5. The method of claim 1, wherein the session key is generated using a nonce generated by the mobile application.

6. The method of claim 1, wherein the session key is generated using a nonce generated by the mobile application server.

7. The method of claim 1, including authenticating a user of the mobile application.

8. The method of claim 1, including deleting the credential from the mobile communication device after displaying the decrypted credential from the mobile application.

9. A method of operating a mobile application to recover a forgotten credential on a mobile communication device, comprising the steps of:

authenticating a user with the mobile application, by entry of a previously registered passcode;

receiving from the user an identification of a forgotten credential to be recovered;

requesting the identified credential from a mobile application server;

securely establishing a session key with the mobile application server;

receiving the credential, encrypted with the session key, from the mobile application server after the mobile application server has received from a credential depository the requested credential in encrypted form, encrypted using an encryption key different from the session key and independent from any information received by the mobile application server from the mobile application, and the mobile application server has decrypted the credential using the encryption key and encrypted the credential using the session key;

decrypting the credential using the session key to form a decrypted credential; and

displaying the decrypted credential to the user;

wherein securely establishing a session key comprises generating the session key, encrypting the session key using one of a public key and a private key corresponding to the public key to form an encrypted session key, sending the encrypted session key, and decrypting the encrypted session key using the other of the public key and the private key corresponding to the public key.

11. A method as in claim 9, wherein the forgotten credential is a PIN for a payment card, and said PIN is not used for user authentication to the mobile application.

12. A method as in claim 9, wherein the encryption key is a symmetric depository key.

13. A method as in claim 9, wherein said passcode comprises biometric data.

10. A method comprising:

establishing a secure session, using a session key, with a mobile application on a mobile communication device, after the mobile application has authenticated a user of the mobile communication device;

receiving a request from the mobile application for a forgotten credential identified by the user of the mobile communication device;

transmitting to a credential depository a request to recover the requested credential from a memory in encrypted form, encrypted using an encryption key different from the session key and independent from any information received at the mobile application server from the mobile application;

receiving the requested credential from the credential depository in said encrypted form;

decrypting the credential using the encryption key and encrypting the credential using the session key; and

transmitting the credential encrypted using the session key to the mobile application so that the mobile application can decrypt the encrypted credential using the session key and display the decrypted credential to the user;

wherein securely establishing a session key comprises generating the session key, encrypting the session key using one of a public key and a private key corresponding to the public key to form an encrypted session key, sending the encrypted session key, and decrypting the encrypted session key using the other of the public key and the private key corresponding to the public key.

14. A method as in claim 10, wherein the forgotten credential is a PIN for a payment card, and said PIN is not used for user authentication to the mobile application.

15. A method as in claim 10, wherein the encryption key is a symmetric depository key.

16. A method as in claim 10, wherein said passcode comprises biometric data.