Systems and methods for contactless card communication and key pair cryptographic authentication using distributed storage

1 . An authentication system, comprising:

a contactless card comprising a processor, a contactless interface, and a memory storing at least one key, a counter value and a unique identifier;

a client device associated with an application and a browser extension; and

a cloud-based authenticator server comprising a processor and a memory,

wherein the client device:

intercept, by the browser extension, a Fast Identity Online (FIDO) authentication request prompted by a website;

redirects, via the browser extension, the FIDO authentication request, to the cloud-based authenticator server;

retrieves, by the application, a ciphertext, from the contactless card, in response to a notification for user identity verification received, by the application from the processor of the cloud-based authenticator server

transmits, by the application, the cipher to the cloud-based authenticator server;

wherein the processor of the cloud-based authenticator server:

receives a FIDO authentication request, redirected by the browser extension associated with the client device,

receives a response comprising the ciphertext from the application executing on the client device,

decrypt the ciphertext included in the response,

authenticates the response including the ciphertext,

encrypts, upon successful authentication of the response, a FIDO challenge associated with the FIDO authentication request, using a FIDO private key stored on the cloud-based authenticator server, to generate a signed FIDO challenge, and

transmits a FIDO public key associated with the FIDO private key to the website, wherein the website decrypts the signed FIDO challenge using the public key to verify the signed FIDO challenge; and

wherein the processor of the contactless card:

generates the ciphertext using the at least one key, and the counter value, stored in the memory of the contactless card, and

transmits, in response to one or more near field communication data exchange (NDEF) reads, the ciphertext to the application executing on the client device.

2 . The authentication system of claim 1 , wherein the client device is associated with a user of the contactless card.

3 . The authentication system of claim 2 , wherein the response received by cloud-based authenticator server from the application executing on the client device comprises one or more input data provided by the user.

4 . The authentication system of claim 1 , wherein the processor of the cloud-based authenticator server stores the FIDO private key in a secure element.

5 . The authentication system of claim 1 , wherein the FIDO public key, transmitted by the cloud-based authenticator server, is received by the browser extension associated with the client device and used by the browser extension to decrypt and validate the signed FIDO challenge.

6 . The authentication system of claim 1 , wherein the cloud-based authenticator server comprises a cloud-based authenticator.

7 . The authentication system of claim 3 , wherein the one or more input data comprises at least one selected from the group of biometric data and login data.

8 . The authentication system of claim 1 , wherein the FIDO private key and the FIDO public key are generated by the cloud-based authenticator server in response to the FIDO authentication request redirected, by the browser extension, from the client device.

9 . The authentication system of claim 8 , wherein the FIDO authentication request corresponds to a FIDO website registration request.

10 . The authentication system of claim 5 , wherein the browser extension transmits the FIDO public key received, by the browser extension associated with the client device, from the cloud-based authenticator server, to the website.

11 . The authentication system of claim 9 , wherein the FIDO public key is transmitted, by the cloud-based authenticator server, to a website associated with the FIDO website registration request.

12 . A method of authentication, the method comprising the steps of:

intercepting by a client device a Fast identity Online (FIDO) authentication request prompted by a website;

redirecting, via a browser extension associated with the client device, the FIDO authentication request, to a cloud-based authenticator server;

receiving, by an application executing on the client device, a notification for user identity verification, from the cloud-based authenticator server;

retrieving, by the application executing on the client device, a ciphertext, from a contactless card, in response to the notification for user identity verification, wherein the ciphertext is generated by the contactless card, using at least one key and a counter value stored on a memory of the contactless card;

transmitting, by the application, a response including the ciphertext to the cloud-based authenticator server;

decrypting by the cloud-based authenticator the ciphertext included in the response;

authenticating, by the cloud-based authenticator server, the ciphertext included in the response;

encrypting, by the cloud-based authenticator server, upon successful authentication of the ciphertext, a FIDO challenge, associated with the FIDO authentication request, using a FIDO private key stored on the cloud-based authenticator authentication server, thereby generating a signed FIDO challenge;

transmitting a FIDO public key associated with the FIDO private key, to the website; and

decrypting, by the website, the signed FIDO challenge using the FIDO public key and verifying the signed challenge.

13 . The method of claim 12 , wherein the client device and the contactless card are associated with a same user.

14 . The method of claim 12 , further comprising transmitting, by the cloud-based authenticator server, a third request.

15 . The method of claim 14 , further comprising receiving, by the cloud-based authenticator server, a second response that is responsive to the third request, the second response comprising input data.

16 . The method of claim 15 , wherein the input data comprises at least one selected from a group of biometric data and login data.

17 . The method of claim 12 , wherein the FIDO private key is stored in a secure element hosted in the cloud, the secure element being associated with the cloud-based authentication authenticator server.

18 . The method of claim 12 , wherein the counter value is incremented, by the contactless card, following the generation of the ciphertext.

19 . The method of claim 12 , wherein the application, executing on the client device, receives the ciphertext when a near field communication (NFC) tag of the contactless card is read by the client device.

20 . The method of claim 12 , wherein the client device corresponds to a communication device associated with a user of the contactless card.