Systems and methods for cryptographic authentication of contactless cards

• US 10,992,477 B2
• Filed: 10/01/2019
• Issued: 04/27/2021
• Est. Priority Date: 10/02/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Rule, Jeffrey, Osborn, Kevin
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US16/589,352
• Publication Number:
  US 20200106615A1
• Time in Patent Office: 574 Days
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/3563 Software being resident on card
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules

Abstract

Example embodiments of systems and methods for data transmission between a contactless card, a client device, and one or more servers are provided. One or more applets of the contactless card are configured to dynamically generate an encrypted payload appended to a link, wherein the contactless card is configured to transmit the link with the appended payload to the client device via one or more gestures. The one or more servers are configured to receive the payload from the client device via one or more applications, parse and decrypt the payload after launch of one or more applications, and transmit one or more notifications to the client device based on a status associated with decryption of the payload. The client device is granted access to a plurality of services associated with the one or more servers based on the one or more notifications received from the one or more servers.

Claims

1. An encrypted payload system comprising:

a contactless card including a processor and a memory, wherein the memory includes a plurality of applets, wherein one or more applets are configured to dynamically generate an encrypted payload including a one-time password appended to a uniform resource locator, wherein the payload is configured to verify a user identity and personalize the uniform resource locator based on the user identity; and

one or more servers in communication with the contactless card;

wherein the contactless card is configured to transmit the uniform resource locator with the payload via a plurality of entries within a communication field;

wherein the one or more servers are configured to receive the payload;

wherein the one more servers are configured to parse and decrypt the payload;

wherein the one or more servers are configured to transmit one or more notifications based on a status associated with decryption of the payload;

wherein the one or more servers are configured to grant access to a plurality of services associated with the one or more servers based on the one or more notifications, the one-time password, and the plurality of entries within the communication field,

wherein each of the plurality of entries within the communication field corresponds to a different service that is selected from the plurality of services, and

wherein the plurality of entries comprises a first entry triggering an activation process of the contactless card and a second entry initiating a phone call.

2. The encrypted payload system of claim 1, wherein the payload comprises a delimiter.

3. The encrypted payload system of claim 1, wherein at least one notification comprises an authentication message transmitted by the one or more servers.

4. The encrypted payload system of claim 1, wherein at least one notification comprises a failure message, such that a predetermined time delay is triggered by the one or more servers which increases by a predetermined amount for each unsuccessful decryption of the payload so as to allow for successful decryption of the payload within the predetermined amount.

5. The encrypted payload system of claim 1, wherein the payload is decrypted using one or more symmetric key decryption algorithms.

6. The encrypted payload system of claim 1, wherein the payload is generated by one or more random number generator algorithms.

7. The encrypted payload system of claim 1, wherein the uniform resource locator is configured to launch a client application.

8. The encrypted payload system of claim 1, wherein at least one gesture associated with the plurality of entries triggers redirect to a web site by the one or more servers.

9. The encrypted payload system of claim 1, wherein at least one gesture associated with the plurality of entries triggers access to a website previously authorized.

10. A method of granting access comprising:

dynamically generating, by a contactless card, an encrypted payload including a one-time password appended to a uniform resource locator, wherein the payload is configured to verify a user identity so as to personalize the uniform resource locator;

transmitting, by the contactless card via a plurality of entries into a communication field, the uniform resource locator and the payload;

receiving, at one or more servers, the payload;

decrypting, by the one or more servers, the payload;

transmitting, by the one or more servers, one or more messages based on a status associated with decryption of the payload; and

granting, by the one or more servers, access to a plurality of resources associated with the one or more servers based on the one or more messages, the one-time password, and the plurality of entries within the communication field, wherein;

each of the plurality of entries within the communication field corresponds to a different resource that is selected from the plurality of resources, and

the plurality of entries comprises a first entry triggering an activation process of the contactless card and a second entry initiating a phone call.

11. The method of granting access of claim 10, wherein the payload comprises a delimiter.

12. The method of granting access of claim 10, wherein the payload is decrypted using one or more public key decryption algorithms.

13. The method of granting access of claim 10, wherein the payload is generated by one or more random number generator algorithms.

14. The method of granting access of claim 10, wherein uniform resource locator is configured to launch a client application.

15. The method of granting access of claim 10, wherein at least one message is generated and comprises a failure message, such that a predetermined time delay is triggered by the one or more servers which increases by a predetermined amount for each unsuccessful decryption of the payload so as to allow for successful decryption of the payload within the predetermined amount.

16. The method of granting access of claim 10, wherein at least one gesture associated with the plurality of entries triggers access to a website previously authorized.

17. The method of granting access of claim 10, wherein at least one gesture associated with the plurality of entries triggers redirect to a website.

18. The method of granting access of claim 10, wherein at least one gesture associated with the plurality of entries triggers an activation process of the contactless card by the one or more servers.

19. A contactless card comprising:

one or more processors, and a memory, wherein the memory includes one or more applets, wherein the one or more applets are configured to dynamically generate an encrypted payload including a one-time password appended to a uniform resource locator, wherein the payload is configured to verify an identity so as to personalize the uniform resource locator;

wherein the contactless card is configured to transmit the uniform resource locator with the payload via a plurality of entries into a communication field,

wherein the payload is decrypted so as to provide access to a plurality of services associated with one or more servers, and the access is based on the one-time password and the plurality of entries into the communication field,

wherein each of the plurality of entries within the communication field corresponds to a different service that is selected from the plurality of services, and

wherein the plurality of entries comprises a first entry triggering an activation process of the contactless card and a second entry initiating a phone call.