Systems and methods for cryptographic authentication of contactless cards
Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.
1. An authentication server comprising:
a processor and memory, the memory including a master key, wherein the processor is configured to:
receive a transmission comprising a cryptographic result and encrypted transmission data, wherein:
the cryptographic result includes a counter value,
the cryptographic result is generated using one or more cryptographic algorithms and a diversified key,
the diversified key is generated using a diversified master key, one or more cryptographic algorithms, and the counter value, and
the encrypted transmission data is encrypted using the one or more cryptographic algorithms and the diversified key;
generate an authentication diversified key based on the master key and a unique identifier;
generate a session key based on the authentication diversified key and the cryptographic result;
decrypt the encrypted transmission data and validate the cryptographic result using the one or more cryptographic algorithms and the session key; and
update the counter value for each transmission received.
2. The authentication server of claim 1 , wherein the counter value comprises a one-time passcode.
3. The authentication server of claim 1 , wherein the one or more cryptographic algorithms include a cryptographic MAC function.
4. The authentication server of claim 1 , wherein a unique diversified session key is generated for each transmission.
5. The authentication server of claim 4 , wherein the unique diversified session key is generated using a portion of the counter value.
6. The authentication server of claim 4 , wherein the unique diversified session key is generated utilizing a different counter value.
7. The authentication server of claim 1 , wherein the master key is limited to a predetermined number of uses.
8. The authentication server of claim 1 , wherein the master key is limited to use during a predetermined time period.
9. The authentication server of claim 1 , wherein the authentication server is configured to receive the transmission from a transmitting device via one or more intermediary devices.
10. The authentication server of claim 9 , wherein the transmitting device comprises a contactless card and one of the one or more intermediary devices comprises a smartphone.
11. The authentication server of claim 1 , wherein the encrypted transmission data comprises activation data for a payment card.
12. A method for transmitting data by a transmitting device having a processor and a memory, the memory containing a master key, an identification number, and a counter, the method comprising:
generating a device key using the master key and the identification number;
generating a first session key using the device key and a first portion of the counter and a second session key using the device key and a second portion of the counter, wherein the first portion of the counter is different than the second portion of the counter;
generating a cryptographic result including the counter using one or more cryptographic algorithms and the device key;
generating a cryptogram using the first session key, the cryptogram including the cryptographic result and the identification number;
encrypting the cryptogram using the second session key; and
transmitting the encrypted cryptogram and the cryptographic result.
13. The method of claim 12 , wherein the counter value comprises a one-time passcode.
14. The method of claim 12 , wherein a unique diversified session key is generated for each transmission by the transmitting device.
15. The method of claim 14 , wherein the unique diversified session key is generated using a portion of the counter value.
16. The method of claim 15 , wherein the unique diversified session key is generated utilizing a different counter value.
17. The method of claim 12 , wherein the master key is limited to a predetermined number of uses.
18. The method of claim 12 , wherein the master key is limited to use during a predetermined time period.
19. The method of claim 12 , wherein the transmitting device comprises a contactless card and the cryptogram comprises activation data for the contactless card.
20. A computer readable non-transitory medium comprising instructions for execution on a processor and comprising the steps of:
receiving a transmission comprising a cryptographic result and encrypted transmission data, wherein:
the cryptographic result includes a counter value,
the cryptographic result is generated using one or more cryptographic algorithms and a diversified key,
the diversified key is generated using a diversified master key, one or more cryptographic algorithms, and the counter value, and
the encrypted transmission data is encrypted using the one or more cryptographic algorithms and the diversified key;
generating an authentication diversified key based on a master key and a unique identifier;
generating a session key based on the authentication diversified key and the cryptographic result;
decrypting the encrypted transmission data and validate the cryptographic result using the one or more cryptographic algorithms and the session key; and
updating the counter value for each transmission received.
21. The computer readable non-transitory medium of claim 20 , wherein the counter value comprises a one-time passcode.
22. The computer readable non-transitory medium of claim 20 , wherein the one or more cryptographic algorithms include a cryptographic MAC function.
23. The computer readable non-transitory medium of claim 20 , wherein a unique diversified session key is generated for each transmission.
24. The computer readable non-transitory medium of claim 23 , wherein the unique diversified session key is generated using a portion of the counter value.
25. The computer readable non-transitory medium of claim 23 , wherein the unique diversified session key is generated using a different counter value.
26. The computer readable non-transitory medium of claim 20 , wherein the master key is limited to a predetermined number of uses.
27. The computer readable non-transitory medium of claim 20 , wherein the master key is limited to use during a predetermined time period.
28. The computer readable non-transitory medium of claim 20 , wherein the transmission is received from a transmitting device via one or more intermediary devices.
29. The computer readable non-transitory medium of claim 28 , wherein the transmitting device comprises a contactless card and one of the one or more intermediary devices comprises a smartphone.
30. The computer readable non-transitory medium of claim 29 , wherein the cryptographic result comprises activation data for the contactless card.