Systems and methods for cryptographic authentication of contactless cards
Example embodiments of systems and methods for data transmission in a contactless card are provided. The contactless card may include a processor, and a memory. The memory may contain a first applet, a second applet, and a plurality of keys. The first applet and the second applet may be stored within a shared security domain. The second applet may be configured to communicate with the first applet to perform one or more cryptographic services. The second applet may be configured to transmit one or more requests to the first applet to encode one or more payload strings based on the plurality of keys to perform the one or more cryptographic services. The first applet may be configured to perform the one or more cryptographic services on behalf of the second applet based on the one or more requests.
1. A contactless card sharing system comprising:
a contactless card including a processor and a memory, wherein the memory contains a first applet, a second applet, and a plurality of keys, and wherein the first applet and the second applet are stored within a shared security domain,
wherein the second applet is configured to communicate with the first applet to perform one or more cryptographic services,
wherein the second applet is configured to transmit one or more requests to the first applet to encode one or more payload strings based on the plurality of keys to perform the one or more cryptographic services, and
wherein the first applet is configured to perform the one or more cryptographic services on behalf of the second applet based on the one or more requests, wherein the first applet is configured to perform the one or more cryptographic services on behalf of the second applet after a detection of a potential intrusion.
2. The contactless card sharing system of claim 1 , wherein the one or more cryptographic services comprises at least one selected from the group of encryption, decryption, and cryptogram generation.
3. The contactless card sharing system of claim 1 , wherein the first applet and the second applet are stored in different security domains, such that at least one of the security domains allows the first applet and the second applet access to the plurality of keys via one or more shared objects.
4. The contactless card sharing system of claim 1 , wherein the first and second applets are firewalled from each other and communicate via one or more secure tunnels.
5. The contactless card sharing system of claim 1 , wherein one or more keys of a corresponding secure element are destroyed based on the determination of a potential intrusion of the second applet.
6. The contactless card sharing system of claim 5 , wherein at least one key comprises a single-use token.
7. The contactless card sharing system of claim 1 , further comprising a server that is configured to alternate amongst the plurality of keys based on one or more security rules.
8. The contactless card sharing system of claim 7 , wherein the one or more security rules are associated with rotating between the plurality of keys in a random sequence.
9. The contactless card sharing system of claim 7 , wherein the one or more security rules are associated with rotating between the plurality of keys in a predetermined sequence based on a declaration table.
10. The contactless card sharing system of claim 9 , wherein each of the plurality of keys is assigned an odd number or an even number, and the predetermined sequence selects between odd and even numbers.
11. The contactless card sharing system of claim 9 , wherein each of the plurality of keys is assigned a prime number or non-prime number, and the predetermined sequence selects between prime and non-prime numbers.
12. A method of sharing private keys in a contactless card comprising:
establishing communication between a first applet and a second applet of a contactless card, the contactless card comprising one or more processors and memory, wherein the memory contains the first and second applets and a plurality of private keys, and wherein the first and second applets are created within a shared security domain;
communicating, by the second applet, a first request to the first applet to perform one or more cryptographic operations;
retrieving, by the first applet, the plurality of private keys based on the first request;
receiving, at the second applet, from the first applet one or more payload strings based on the plurality of private keys; and
performing, based on the plurality of private keys, the one or more cryptographic operations by the first applet on behalf of the second applet based on the first request, wherein one or more private keys of corresponding secure element are destroyed based on a detection of an intrusion of the second applet.
13. The method of sharing private keys of claim 12 , wherein establishing communication between a first applet and a second applet comprises establishing one or more secure tunnels between the first applet and the second applet.
14. The method of sharing private keys of claim 12 , wherein the one or more cryptographic operations comprises at least one selected from the group of encryption, decryption, and cryptogram generation.
15. The method of sharing private keys of claim 12 , wherein the first applet and the second applet are stored in different security domains, such that at least one of the security domains allows the first and second applets access to the plurality of private keys via one or more shared objects.
16. The method of sharing private keys of claim 15 , wherein at least one key of the plurality of private keys comprises a limited duration token.
17. The method of sharing private keys of claim 12 , further comprising:
alternating, by a server, amongst the plurality of private keys based on one or more security rules.
18. A contactless card comprising:
one or more processors and one or more memories, wherein the one or more memories contains a first applet, a second applet, and a plurality of private keys,
wherein the second applet is configured to communicate with the first applet to perform cryptogram generation,
wherein the second applet is configured to transmit one or more requests to the first applet to encode one or more payload strings based on the plurality of private keys to perform the cryptogram generation,
wherein the first applet and the second applet are stored within a first security domain and a second security domain, respectively, and
wherein the first applet is configured to perform the cryptogram generation on behalf of the second applet after a detection of a potential intrusion.