Systems and methods for cryptographic authentication of contactless cards

• US 10,554,411 B1
• Filed: 03/12/2019
• Issued: 02/04/2020
• Est. Priority Date: 10/02/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Ashfield, James, Duane, William, Osborn, Kevin
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US16/351,067
• Time in Patent Office: 329 Days
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Example embodiments of systems and methods for data transmission between contactless card and receiving devices are provided. In an embodiment, the contactless card may be configured to create a cryptogram based on a plurality of keys and a counter. The cryptogram may be transmitted to the receiving device. The contactless card may be configured to transmit a one-time password to the client device. The counter value may be adjusted each time the one-time password is generated, and the counter may be configured to increment in a non-monotonic sequence, the sequence associated with one or more cryptographic algorithms.

Claims

1. A one-time password system comprising:

a contactless card including one or more processors, and a memory, wherein the memory contains at least one applet, at least one key, and a counter;

a client device application comprising instructions for execution on a client device, wherein;

the contactless card is configured to create a cryptogram based on the at least one key and the counter,

the contactless card is configured to transmit the cryptogram to the client device application,

the contactless card is configured to transmit a one-time password to the client device application,

the counter is adjusted each time the password is generated, and

the counter is configured to increment in a non-monotonic sequence, wherein the increment associated with one or more cryptographic algorithms.

2. The one-time password system of claim 1, wherein the counter is configured to begin at different values for each account.

3. The one-time password system of claim 2, wherein the one or more cryptographic algorithms are configured to encrypt a starting value to obtain one or more subsequent counter values.

4. The one-time password system of claim 1, wherein the one or more cryptographic algorithms comprise one or more hashing functions to generate the counter.

5. The one-time password system of claim 3, wherein the increment is based on one selected from the group of an assigned sequence and a derived sequence.

6. The one-time password system of claim 5, wherein the increment is based on the sequence and the derived sequence comprises account information and session information.

7. The one-time password system of claim 6, wherein the account information comprises at least one selected from the group of a unique identifier, shared secret, card sequence number, card information, address information, a time of programming of the contactless card, or any combination thereof.

8. The one-time password system of claim 6, wherein the session information comprises one or more random values exchanged during a session established between the client device application and one or more servers.

9. The one-time password system of claim 1, wherein the counter is configured to decrement in a non-monotonic sequence.

10. The one-time password system of claim 1, further comprising one or more servers configured to authenticate the one-time password received by the client device application.

11. A method for securing counter-based one-time passwords with a contactless card, comprising:

providing a contactless card, the contactless card including one or more processors, and a memory including one or more applets, at least one key, and a counter;

creating, by the one or more processors, a cryptogram based on the at least one key and the counter;

transmitting, by the contactless card, the cryptogram;

transmitting, by the contactless card, one or more one-time passwords;

wherein the counter is adjusted each time the password is generated, and

wherein the counter is configured to increment in a non-monotonic sequence, the increment associated with one or more cryptographic algorithms.

12. The method for securing counter-based one-time passwords of claim 11, wherein counter is configured to begin at different values for each account.

13. The method for securing counter-based one-time passwords of claim 12, wherein the one or more cryptographic algorithms are configured to encrypt a starting value to obtain one or more subsequent counter values.

14. The method for securing counter-based one-time passwords of claim 11, wherein the one or more cryptographic algorithms comprise one or more hashing functions to generate the counter.

15. The method for securing counter-based one-time passwords of claim 11, wherein the increment is based on one selected from the group of an assigned sequence and a derived sequence.

16. The method for securing counter-based one-time passwords of claim 15, wherein the increment is based on the derived sequence and the derived sequence comprises account information and session information.

17. The method for securing counter-based one-time passwords of claim 16, wherein the account information comprises at least one selected from the group of a unique identifier, shared secret, card sequence number, card information, address information, a time of programming of the contactless card, or any combination thereof.

18. The method for securing counter-based one-time passwords of claim 11, further comprising:

providing a first level of access associated with one or more services upon determination of a successful validation of the one or more one-time passwords.

19. The method for securing counter-based one-time passwords of claim 18, further comprising:

providing a second level of access associated with the one or more services upon determination of an unsuccessful validation of the one or more one-time passwords.

20. A contactless card comprising:

one or more processors, a counter, and a memory, wherein the memory contains at least one applet,

wherein the contactless card is configured to;

generate a one-time password,

transmit the one-time password, and

adjust the counter with the generation of each one-time password, wherein the counter is configured to increment or decrement in a non-monotonic sequence,

wherein a value of the increment or decrement is selected so as to avoid the counter prematurely wrapping, and

wherein the counter is associated with one or more cryptographic algorithms.