Systems and methods for cryptographic authentication of contactless cards

• US 10,623,393 B1
• Filed: 10/01/2019
• Issued: 04/14/2020
• Est. Priority Date: 10/02/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Osborn, Kevin, Ashfield, James, Rule, Jeffrey
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US16/589,192
• Publication Number:
  US 20200106756A1
• Time in Patent Office: 196 Days
• Field of Search: 726 3
• CPC Class Codes: G06Q 20/409 Device specific authentication in transaction processing
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/0893 the card reader reading the card in a contactless manner
• CPC Class Codes: G07F 7/122 Online card verification
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

Example embodiments of systems and methods for data transmission between a contactless card, a client device, and one or more servers are provided. The memory of the contactless card may include one or more applets and a counter. The client device may be in data communication with the contactless card and one or more servers, and the one or more servers may include an expected counter value. The client device may be configured to read the counter from the contactless card and transmit it to the one or more servers. The one or more servers may compare the counter to the expected counter value for synchronization. The contactless card and the one or more servers may resynchronize the counter, via one or more processes, based on one or more reads of the one or more applets. The one or more servers may authenticate the contactless card based on the resynchronization.

Claims

1. A counter resynchronization system comprising:

a contactless card including one or more processors and a memory, wherein the memory comprises one or more applets and a counter;

a client application comprising instructions for execution on a client device including one or more processors and a memory; and

one or more servers in data communication with the client application, the one or more servers including a memory comprising an expected counter value,

wherein the client application is configured to read the counter from the contactless card and transmit the counter to the one or more servers,

wherein the one or more servers are configured to compare the counter to the expected counter value for synchronization,

wherein the contactless card and the one or more servers are configured to resynchronize the counter, via one or more processes, based on one or more reads of the one or more applets, and

wherein the one or more servers are configured to authenticate the contactless card based on the resynchronization.

2. The counter resynchronization system of claim 1, wherein the counter is assigned a counter value by the contactless card to signal one or more attacks.

3. The counter resynchronization system of claim 1, wherein the contactless card and the one or more servers are configured to increment the counter in a non-monotonic sequence.

4. The counter resynchronization system of claim 1, wherein a first process includes the client application configured to perform the one or more reads of the one or more applets during a single gesture by the contactless card within a data communication field of the client application, and the one or more servers are configured to receive the one or more reads from the client application based on the single gesture so as to resynchronize the counter.

5. The counter resynchronization system of claim 1, wherein a second process includes the client application configured to perform the one or more reads of the one or more applets during two or more gestures by the contactless card within a data communication field of the client application, and the one or more servers are configured to receive the one or more reads from the client application based on the two or more gestures so as to resynchronize the counter.

6. The counter resynchronization system of claim 5, wherein the two or more gestures comprise a wave, tap, or swipe, or any combination thereof by the contactless card to the client application.

7. The counter resynchronization system of claim 4, wherein the first process includes a first window and is configured to determine if an increment of the counter belongs to a first monotonic sequence within the first window.

8. The counter resynchronization system of claim 7, wherein if the increment of the counter does not belong to the first monotonic sequence within the first window, the contactless card is prompted for one or more additional gestures.

9. The counter resynchronization system of claim 8, wherein, responsive to the one or more additional gestures, the counter is resynchronized if the counter is within a second window including a second monotonic sequence.

10. The counter resynchronization system of claim 8, wherein, responsive to the one or more additional gestures, the contactless card is deactivated if the counter falls outside a second window.

11. A method of resynchronizing a counter in a contactless card comprising:

communicating, by a contactless card, to a client application comprising instructions for execution on a client device, the client application also in communication with one or more servers, the contactless card including one or more processors and a memory, wherein the memory comprises one or more applets and a counter;

comparing, by the one or more servers, the counter received from the client application to an expected counter value for synchronization;

resynchronizing the counter, via one or more resynchronization processes, based on one or more reads of the one or more applets; and

authenticating, by the one or more servers, the contactless card based on resynchronizing the counter.

12. The method of resynchronizing a counter of claim 11, wherein the counter is configured to increment in a non-monotonic sequence.

13. The method of resynchronizing a counter of claim 11, wherein

the one or more resynchronization processes include a first resynchronization process, and

wherein the first resynchronization process includes:

performing, by the client application, the one or more reads of the one or more applets during a single gesture of the contactless card, and

receiving, by the one or more servers, the one or more reads from the client application so as to resynchronize the counter.

14. The method of resynchronizing a counter of claim 13, wherein the single gesture comprises a wave, tap, or swipe or any combination thereof by the contactless card to the client application.

15. The method of resynchronizing a counter of claim 13, wherein the first resynchronization process is configured to determine if an increment of the counter belongs to a first non-monotonic sequence within a first window.

16. The method of resynchronizing a counter of claim 15, wherein if the increment of the counter does not belong to the first non-monotonic sequence within the first window, the contactless card is prompted for one or more additional gestures.

17. The method of resynchronizing a counter of claim 16, wherein, responsive to the one or more additional gestures, the counter is resynchronized if the counter is within a second window, wherein the second window includes a second non-monotonic sequence.

18. The method of resynchronizing a counter of claim 17, wherein, responsive to the one or more additional gestures, the contactless card is deactivated if the counter falls outside a second window.

19. The method of resynchronizing a counter of claim 11, wherein the counter is configured to increment in a monotonic sequence.

20. A contactless card comprising:

one or more processors and a memory, wherein the memory comprises one or more applets and a counter;

wherein the counter is resynchronized, via a resynchronization process, based on one or more reads of the one or more applets,

wherein the resynchronization process includes;

performing, by a client application comprising instructions for execution on a client device, the one or more reads of the one or more applets during a single gesture by the contactless card,

receiving, by the one or more servers, the one or more reads from the client application based on the single gesture, and

resynchronizing the counter, by the contactless card,

wherein the single gesture comprises a wave, tap, or swipe or any combination thereof by the contactless card to the client application, and

wherein the resynchronization process includes a first window and is configured to determine if an increment of the counter belongs to a first non-monotonic sequence within the first window.