Systems and Methods for Authenticating Mobile Devices

• US 20120300938A1
• Filed: 05/25/2012
• Published: 11/29/2012
• Est. Priority Date: 05/26/2011
• Status: Active Grant

• Current Assignee: First Data Corporation (Fiserv Incorporated)
• Original Assignee: First Data Corporation (Fiserv Incorporated)
• Inventors: Kean, Brian, Cambridge, Devin Michael
• Granted Patent: US 9,059,980 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06Q 20/00 Payment architectures, schemes or protocols apparatus for performing or posting payment transactions G07F7/08, G07F19/00; electronic cash registers G07G1/12
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Embodiments of the invention provide systems and methods for authenticating mobile devices. Device identifying information may be received for a mobile device. A base level key may also be communicated to the mobile device. The base level key may be utilized by the mobile device to derive unique transaction specific keys to encrypt subsequent communications output by the mobile device. A communication encrypted with a unique transaction specific key may be received from the mobile device. Based at least in part upon the device identifying information and the base level key, a derived key may be generated, and the derived key may be utilized to decrypt the received communication and authenticate the mobile device. In certain embodiments, the above operations may be performed by one or more computers associated with a service provider.

Claims

1. A computer-implemented method for authenticating mobile devices, the method comprising:

receiving, from a mobile device, device identifying information for the mobile device;

communicating, to the mobile device, a base level key utilized by the mobile device to derive unique transaction specific keys to encrypt subsequent communications output by the mobile device;

receiving, from the mobile device, a communication encrypted with a unique transaction specific key;

generating, based at least in part upon the device identifying information and the base level key, a derived key; and

utilizing the derived key to decrypt the received communication and authenticate the mobile device,

wherein the above operations are performed by one or more computers associated with a service provider.

2. The computer-implemented method of claim 1, further comprising:

provisioning the mobile device with an application configured to derive the unique transaction specific keys,

wherein communicating a base level key comprises communicating a base level key during the provisioning of the application.

3. The computer-implemented method of claim 1, further comprising:

receiving, from the mobile device, an identifier associated with the unique transaction specific key; and

utilizing the received identifier to identify the derived key.

4. The computer-implemented method of claim 1, wherein generating a derived key comprises generating a derived key utilizing a derived unique key per transaction (DUKPT) process.

5. The computer-implemented method of claim 4, wherein generating a derived key comprises:

combining the base level key with at least a portion of the device identifying information to derive an intermediary key; and

providing the intermediary key to the DUKPT process to generate the derived key.

6. The computer-implemented method of claim 1, wherein receiving device identifying information comprises receiving a card product life cycle (CPLC) for the device.

7. The computer-implemented method of claim 1, further comprising:

storing the received device identifying information.

8. The computer-implemented method of claim 1, wherein receiving a communication encrypted with a unique transaction specific key comprises receiving a communication during a secure socket layer (SSL) handshake with the mobile device.

9. A system for authenticating mobile devices, the system comprising:

at least one memory configured to store computer-executable instructions; and

at least one processor configured to access the at least one memory and execute the computer-executable instructions to;

receive, from a mobile device, device identifying information for the mobile device;

direct communication, to the mobile device, of a base level key utilized by the mobile device to derive unique transaction specific keys to encrypt subsequent communications output by the mobile device;

receive, from the mobile device, a communication encrypted with a unique transaction specific key;

generate, based at least in part upon the device identifying information and the base level key, a derived key; and

utilize the derived key to decrypt the received communication and authenticate the mobile device.

10. The system of claim 9, wherein the at least one processor is further configured to execute the computer-executable instructions to:

direct provisioning of the mobile device with an application configured to derive the unique transaction specific keys,

wherein the base level key is communicated during the provisioning of the application.

11. The system of claim 9, wherein the at least one processor is further configured to execute the computer-executable instructions to:

receive, from the mobile device, an identifier associated with the unique transaction specific key; and

utilize the received identifier to identify the derived key.

12. The system of claim 9, wherein the derived key is generated utilizing a derived unique key per transaction (DUKPT) process.

13. The system of claim 12, wherein the at least one processor is further configured to execute the computer-executable instructions to:

combine the base level key with at least a portion of the device identifying information to derive an intermediary key; and

provide the intermediary key to the DUKPT process to generate the derived key.

14. The system of claim 9, wherein the received device identifying information comprises a card product life cycle (CPLC) for the device.

15. The system of claim 9, wherein the at least one processor is further configured to execute the computer-executable instructions to:

direct storage of the received device identifying information.

16. The system of claim 9, wherein the communication encrypted with a unique transaction specific key is received during a secure socket layer (SSL) handshake with the mobile device.

17. A computer-implemented method for authenticating a mobile device, the method comprising:

communicating, by a mobile device to a service provider, device identifying information for the mobile device;

receiving, by the mobile device from the service provider, a base level key;

utilizing, by the mobile device, the base level key to derive a unique transaction specific key;

encrypting, by the mobile device utilizing the derived unique transaction specific key, a communication; and

outputting, by the mobile device to the service provider, the encrypted communication,

wherein the service provider utilizes the device identifying information and the base level key to generate a key to decrypt the communication and authenticate the mobile device.

18. The computer-implemented method of claim 17, wherein receiving a base level key comprises receiving the base level key during the provision of the mobile device with an application configured to derive the unique transaction specific keys.

19. The computer-implemented method of claim 17, further comprising:

communicating, from the mobile device to the service provider, an identifier associated with the unique transaction specific key,

wherein the service provider utilizes the received identifier to identify the generated key utilized to decrypt the communication.

20. The computer-implemented method of claim 17, wherein deriving a unique transaction specific key comprises generating a unique transaction specific key utilizing a derived unique key per transaction (DUKPT) process.

21. The computer-implemented method of claim 17, wherein generating a unique transaction specific key comprises:

combining, by the mobile device, the base level key with at least a portion of the device identifying information to derive an intermediary key; and

providing, by the mobile device, the intermediary key to the DUKPT process to generate the derived key.

22. The computer-implemented method of claim 21, wherein combining the base level key with at least a portion of the device identifying information comprises combining the base level key with at least a portion of a card product life cycle (CPLC) for the device.

23. The computer-implemented method of claim 17, further comprising:

storing, by the mobile device, the base level key in a secure element associated with the mobile device.

24. The computer-implemented method of claim 17, wherein outputting the encrypted communication comprises outputting the encrypted communication during a secure socket layer (SSL) handshake between the mobile device and the service provider.