Systems and methods for cryptographic authentication of contactless cards

• US 10,965,465 B2
• Filed: 10/23/2019
• Issued: 03/30/2021
• Est. Priority Date: 10/02/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Rule, Jeffrey, Ilincic, Rajko
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US16/661,420
• Publication Number:
  US 20200119924A1
• Time in Patent Office: 524 Days
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. These systems and methods may provide for the secure transmission of sensitive information, such personally-identifiable information. In some examples, the sensitive information may be requested and securely shared when cryptographically signed by the user, and the user may control the access of viewers to the personally identifiable information or end users.

Claims

1. A contactless card comprising:

a memory including a counter value, and one or more keys;

a communication interface; and

one or more processors in communication with the memory and communication interface,

wherein the one or more processors are configured to;

update the counter value when the communication interface is within a range of a first active communication field of a first device, the first device including a first application comprising instructions for execution on the first device;

create a first cryptogram based on the one or more keys and the counter value;

transmit, to the first application, the first cryptogram via the first active communication field;

receive, from the first application, a request for data;

update the counter value when the communication interface is within a range of a second active communication field of a second device, the second device including a second application comprising instructions for execution on the second device;

create a second cryptogram based on the one or more keys and the counter value; and

transmit, to the second application, a response responsive to the request for data via the second active communication field, the response comprising the second cryptogram, wherein the second cryptogram authorizes access to the data.

2. The contactless card of claim 1, wherein the request for data comprises personally identifiable information.

3. The contactless card of claim 1, wherein the request for data is transmitted from the first application.

4. The contactless card of claim 1, wherein the response further comprises one or more parameters so as to authorize access to the data.

5. The contactless card of claim 4, wherein the one or more parameters includes one or more login credentials that are transmitted to the second application.

6. The contactless card of claim 1, wherein the data is included in at least one selected from the group of a cloud storage, a secure element, and a blockchain.

7. The contactless card of claim 1, wherein the request for data is subject to a single use.

8. The contactless card of claim 1, wherein the response is signed with the one or more keys from the contactless card.

9. The contactless card of claim 1, wherein the second cryptogram is generated by entry of the contactless card into the second active communication field via one or more gestures including at least one selected from the group of a tap, swipe, and wave.

10. The contactless card of claim 1, wherein the request for data expires after authorized access to the data.

11. A method for secure data transmission, the method comprising the steps of:

updating, by one or more processors of a contactless card, a counter value when a communication interface of the contactless card is within a range of a first active communication field of a first device, the contactless card comprising;

a memory including the counter value, and one or more keys, wherein the one or more processors are in communication with the memory and communication interface, the first device including a first application comprising instructions for execution on the first device;

creating, by the one or more processors, a first cryptogram based on the one or more keys and the counter value;

transmitting, by the one or more processors, the first cryptogram to the first application via the first active communication field;

receiving, from the first application, a request for one or more subsets of a data set;

updating, by the one or more processors, the counter value when the communication interface is within a range of a second active communication field of a second device, the second device including a second application comprising instructions for execution on the second device;

creating, by the one or more processors, a second cryptogram based on the one or more keys and the counter value; and

transmitting, by the one or more processors, a response responsive to the request for the one or more subsets via the second active communication field to the second application, the response comprising the second cryptogram, wherein the second cryptogram authorizes access to the one or more subsets.

12. The method for secure data transmission of claim 11, wherein the one or more subsets is included in at least one of a cloud storage, a secure element, and a blockchain.

13. The method for secure data transmission of claim 12, wherein the request for the one or more subsets is subject to a single use.

14. The method for secure data transmission of claim 11, wherein the response is signed with the one or more keys from the contactless card.

15. The method for secure data transmission of claim 14, wherein the signed response is transmitted to the first application for validation.

16. The method for secure data transmission of claim 11, wherein the request for the one or more subsets is subject to a predetermined time period.

17. The method for secure data transmission of claim 11, wherein the second cryptogram is generated by entry of the contactless card into the second active communication field via one or more gestures including at least one selected from the group of a tap, swipe, and wave.

18. The method for secure data transmission of claim 11, wherein the response further comprises one or more parameters so as to authorize access to the one or more sub sets.

19. The method for secure data transmission of claim 18, wherein the one or more parameters includes one or more login credentials that are transmitted to the second application.

20. A transmitting device comprising:

a memory including a counter value, and one or more keys;

a communication interface; and

one or more processors in communication with the memory and communication interface, wherein the one or more processors are configured to;

update the counter value when the communication interface is within a range of a first active communication field of a first device, the first device including a first application comprising instructions for execution on the first device;

create a first cryptogram based on the one or more keys and the counter value;

transmit, to the first application, the first cryptogram via the first active communication field;

receive, from the first application, a request for data;

update the counter value when the communication interface is within a range of a second active communication field of a second device, the second device including a second application comprising instructions for execution on the second device;

create a second cryptogram based on the one or more keys and the counter value; and

transmit, to the second application, a response responsive to the request for data via the second active communication field, the response comprising the second cryptogram and one or more credentials, wherein the second cryptogram and the one or more credentials authorizes access to the data.