Card credential method and system

1. A method comprising:

generating, using a processor, a card credential, wherein

the generating the card credential comprises encrypting a card key using a server encryption key; and

transmitting the card credential to an access card, wherein

the access card is configured to transmit the card credential in an authentication interaction, and

the authentication interaction comprises

the card key being obtained from the card credential using a server decryption key, and

a response data being generated based on at least

the card key,

a challenge data, and

a card authentication protocol.

2. The method of claim 1 , wherein the authentication interaction further comprises a request for authentication being received, wherein the request for authentication comprises the card credential and a candidate response, the candidate response being compared to the response data, and an authentication output being generated based at least on the comparing.

3. The method of claim 1 , wherein the authentication interaction further comprises

a request for authentication being received, wherein

the request for authentication comprises the card credential and a candidate response, and

the obtaining the card key is configured to be performed in response to a receipt of the request.

4. The method of claim 3 , wherein the server decryption key and the server encryption key are a key pair.

5. The method of claim 3 , wherein the server decryption key is the same as the server encryption key.

6. The method of claim 1 , wherein

the access card is configured to perform the authentication interaction with a server, and

in the authentication interaction, the server is configured to obtain the card key from the server decryption key.

7. The method of claim 1 , wherein

in the authentication interaction, the access card is configured to generate the response data.

8. A system comprising:

a data interface;

a memory; and

a processor, coupled to the data interface and the memory, and configured to

generate a card credential into which a card key has been locked using an encryption key stored in the memory, and

transmit the card credential to an access card through the data interface, wherein

the access card is configured to transmit the card credential in an authentication interaction, and

the access card, in the authentication interaction, is further configured to generate the response data based at least on the card key,

a challenge data, and

a card authentication protocol, and wherein

the authentication interaction comprises

the card key being obtained from the card credential using a server decryption key.

9. The system of claim 8 , wherein a server, in the authentication interaction, is configured to

receive a request for authentication through the data interface, wherein the request for authentication comprises the card credential and a candidate response,

obtain the card key from the card credential using a decryption key stored in the memory,

and

generate a negative authentication output if the candidate response does not match the response data.

10. The system of claim 8 , wherein the access card is further configured to

select the card authentication protocol from a plurality of card authentication protocols based on information obtained from the card credential.

11. The system of claim 8 , wherein,

a decryption protocol is used to obtain the card key from the card credential,

the card key is a symmetric key, and

the encryption key and the decryption key are a public-private key pair.

12. The system of claim 8 , wherein

a server is configured to obsolete the card key based on a first key life cycle, and

the server is configured to obsolete the decryption key based on a second key life cycle.

13. The system of claim 12 , wherein

the second key life cycle is substantially longer than the first key life cycle.

14. The system of clam 8 , wherein

the access card is configured to perform the authentication interaction with a server, and

the server is configured to obtain the card key from the server decryption key.

15. A system comprising:

means for generating a card credential, wherein

the means for generating the card credential comprises means for encrypting a card key using a server encryption key; and

means for transmitting the card credential to an access card, wherein

the access card is configured to transmit the card credential in an authentication interaction, and

the authentication interaction comprises

using a server decryption key to obtain the card key from the card credential, and

wherein the access card is further configured to generate a response data based on at least

the card key,

a challenge data, and

a card authentication protocol.

16. The system of claim 15 , wherein

the access card is configured to perform the authentication interaction with a server, and

in the authentication interaction, the server is configured to obtain the card key from the server decryption key.

17. A non-transient computer-readable medium having encoded thereon instruction executable by one or more processors to perform acts comprising:

generating a card credential, wherein

the generating the card credential comprises encrypting a card key using a server encryption key; and

transmitting the card credential to an access card, wherein

the access card is configured to transmit the card credential in an authentication interaction, and

the authentication interaction comprises

the card key being obtained from the card credential using a server decryption key, and

the access card generating a response data based on at least

the card key,

a challenge data, and

a card authentication protocol.

18. The non-transient computer-readable medium of claim 17 , wherein

the access card is configured to perform the authentication interaction with a server,

in the authentication interaction, the server is configured to obtain the card key from the server decryption key, and

in the authentication interaction, the access card is configured to generate the response data.