System and method for binding a smartcard and a smartcard reader
View Patent ↗Systems and methods for binding a smartcard and a smartcard reader are provided. A smartcard is provision to store a first set of credentials for use in traditional transactions such as at a brick and mortar retail store and a second set of credentials for use when performing a transaction using a smartcard reader associated with a user such as an on-line transaction. The user smartcard reader registers with a smartcard issuer server by cryptographically authenticating a secure processor associated with the smartcard reader. As a result of the registration, the secure processor obtains a set of private keys associated with the second set of credentials. When a request for a authorizing a transaction via the user's smartcard reader is received, the smartcard reader cryptographically authenticates itself to the smartcard using a private key associated with a credential to be used to authorize the transaction.
1. A method for using a smartcard issuer server to bind a smartcard having a plurality of credentials to a smartcard reader associated with a secure processor, comprising;
receiving a message from the secure processor including a request for a set of cryptographic keys associated with a set of credentials stored on the smartcard, one cryptographic key per credential;
retrieving the set of cryptographic keys associated with the set of credentials; and
transmitting the set of cryptographic keys to the secure processor, wherein a cryptographic key in the set of cryptographic keys is used to retrieve an associated credential from the smartcard.
2. A method for binding a smartcard to a smartcard reader associated with a secure processor, comprising:
receiving a first cryptographic key associated with a first credential of the smartcard from a server associated with an issuer of the first credential;
receiving a request for authentication data from a service provider server, wherein the authentication request includes a request for the first credential;
authenticating communications with the smartcard using the first cryptographic key; and
receiving a value for the first credential from the smartcard if the authentication is successful.
3. The method of claim 2 , further comprising:
authenticating the server associated with the issuer of the first credential.
4. The method of claim 3 , further comprising:
transmitting a message including a request for the first cryptographic key to the server associated with the issuer of the first credential.
5. The method of claim 2 , further comprising:
storing the first cryptographic key in a memory within a security boundary established by the secure processor.
6. The method of claim 2 , wherein the value for the first credential is a transaction code.
7. The method of claim 6 , wherein the transaction code is a value incremented once per session involving the first credential by the smartcard.
8. The method of claim 6 , wherein the authentication data includes a user log-in and password.
9. The method of claim 2 , wherein the authentication request includes a request for authentication data associated with an additional authentication factor.
10. The method of claim 2 , further comprising:
receiving a second cryptographic key associated with a second credential of the smartcard from a server associated with an issuer of the second credential.
11. The method of claim 10 , further comprising:
receiving a request for authentication data from a second service provider service, wherein the authentication request includes a request for the second credential.
12. The method of claim 11 , further comprising:
authenticating communications with the smartcard using the second cryptographic key; and
receiving a value for the second credential from the smartcard if the authentication is successful.
13. The method of claim 2 , further comprising:
transmitting the first credential to the service provider server.
14. A device for authenticating a user transaction comprising:
a secure processor including a smartcard reader configured to:
receive a first cryptographic key associated with a first credential of the smartcard from a server associated with an issuer of the first credential,
receive a request for authentication data from a service provider server, wherein the authentication request includes a request for the first credential,
authenticate communications with the smartcard using the first cryptographic key, and
receive a value for the first credential from the smartcard if the authentication is successful; and
a memory for storing the first cryptographic key.
15. The device of claim 14 , wherein the memory is within a security boundary established by the secure processor.
16. The device of claim 14 , wherein the smartcard reader is within a security boundary established by the secure processor.
17. The device of claim 16 , wherein the value for the first credential is a transaction code.
18. The device of claim 17 , wherein the transaction code is a value incremented once per session involving the first credential by the smartcard.
19. The device of claim 14 , wherein the secure processor further comprises:
a one-time password generator configured to generate a one-time password for the first credential.
20. The device of claim 19 , wherein the secure processor is configured to authenticate the transaction code using the generated one-time password for the first credential.