Server authentication in non-secure channel card pin reset methods and computer implemented processes

1. A method for resetting a pin on an access card, comprising:

(a) generating a server authentication (SA) public key and an SA private key;

(b) attempting a write of the SA public key to the access card over a non-secure channel;

(c) determining if the access card currently contains an existing SA public key; and

selecting the attempted write of the SA public key from one of:

(i) completing the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the access card did not contain an existing public key;

(ii) denying the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the existing SA public key matches the SA public key that is attempted by the write; and

(iii) denying the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the existing SA public key was written over a non-secure channel and does not match the SA public key that is attempted by the write;

(d) attempting a reset of the pin on the access card from a server.

2. A method for resetting a pin on an access card as recited in claim 1 , wherein the denying of (ii) signals an exception to an applet of the access card, the exception defining a code that prevents the write of the SA public key and allows continuation with an enrollment process to setup the access card for an individual.

3. A method for resetting a pin on an access card as recited in claim 1 , wherein when the non-secure channel is converted into a secure channel, the attempt to write the SA public key is allowed whether or not the existing SA public key is present on the access card.

4. A method for resetting a pin on an access card as recited in claim 1 , wherein the attempting a reset further includes:

initiating a challenge to the server, the challenge being encrypted at the server using the SA private key;

decrypting the encrypted challenge using the SA public key of the access card; and

allowing reset of the pin on the access card when the decrypted challenge matches the challenge initiated to the server.

5. A method for resetting a pin on an access card as recited in claim 4 , further comprising,

receiving an out-of-band reset request indicating an intent to attempt the reset of the pin in operation (d); and

setting a temporary flag to indicate an approval of the out-of-band reset request; and

unsetting the flag when the challenge is encrypted, the reset process attempt is aborted, or a timer associated with the temporary flag has run out.

6. A method for resetting a pin on an access card as recited in claim 4 , wherein allowing the reset of the pin on the access card when the decrypted challenge matches the challenge initiated to the server authenticates the server.

7. A method for resetting a pin on an access card as recited in claim 6 , wherein the server being authenticated ensures that the server is a trusted server containing the SA private key pair that matches the SA public key.

8. A method for resetting a pin on an access card as recited in claim 4 , wherein an authenticate server method enables: (I) generation of the challenge and (II) decryption of the challenge, and setting/not-setting of the pin.

9. A computer readable media containing program instructions for resetting a pin on an access card, the program instructions for resetting a pin on an access card comprising:

(a) program instructions for generating a server authentication (SA) public key and an SA private key;

(b) program instructions for attempting a write of the SA public key to the access card over a non-secure channel;

(c) program instructions for determining if the access card currently contains an existing SA public key; and

selecting the attempted write of the SA public key from one of:

(i) program instructions for completing the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the access card did not contain an existing public key;

(ii) program instructions for denying the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the existing SA public key matches the SA public key that is attempted by the write; and

(iii) program instructions for denying the attempted write of the SA public key to the access card over the non-secure channel if it is determined that the existing SA public key was written over a non-secure channel and does not match the SA public key that is attempted by the write;

(d) program instructions for attempting a reset of the pin on the access card from a server.

10. A computer readable media containing program instructions for resetting a pin on an access card as recited in claim 9 , wherein the program instruction for denying (ii) signals an exception, the exception defining a code that denies the write of the SA public key and continuation with an enrollment process to setup the access card for an individual.

11. A computer readable media containing program instructions for resetting a pin on an access card as recited in claim 9 , wherein when the non-secure channel is converted into a secure channel, the attempt to write the SA public key is allowed whether or not the existing SA public key is present on the access card.

12. A computer readable media containing program instructions for resetting a pin on an access card as recited in claim 9 , wherein the program instructions for attempting a reset of the pin on the access card from a server further include:

program instructions for initiating a challenge to the server, the challenge being encrypted at the server using the SA private key;

program instructions for decrypting the encrypted challenge using the SA public key of the access card; and

program instructions for allowing reset of the pin on the access card when the decrypted challenge matches the challenge initiated to the server.

13. A computer readable media containing program instructions for resetting a pin on an access card as recited in claim 12 , further comprising,

program instructions for receiving an out-of-band reset request indicating an intent to attempt the reset of the pin in operation (d); and

program instructions for setting a temporary flag to indicate an approval of the out-of-band reset request; and

program instructions for unsetting the flag upon completing the encryption of the challenge, the reset process attempt is aborted, or a timer associated with the temporary flag has run out.

14. A computer readable media containing program instructions for resetting a pin on an access card as recited in claim 13 , wherein allowing the reset of the pin on the access card when the decrypted challenge matches the challenge initiated to the server authenticates the server.

15. A computer readable media containing program instructions for resetting a pin on an access card as recited in claim 14 , wherein the server being authenticated ensures that the server is a trusted server containing the SA private key that matches the SA public key, to define a matching asymmetric key pair.