IP Library › Granted Patent US 11,757,662

Granted Patent B2

US 11,757,662 · App. 17/080,525 · Granted Sep 12, 2023

Confidential authentication and provisioning

Inventors: Eric Le Saint (Los Altos, CA); Jing Jin (San Jose, CA); Christian Aabye (Redwood City, CA)

Assignee: Visa International Service Association

H04L9/3273 H04L9/0844 H04L9/0869 H04L9/14 H04L9/3242 H04L9/3265 H04L9/3268 H04L63/0428 H04L63/0442 H04L63/061 H04L63/0869 H04L9/50 H04L2209/04 H04L2209/08 H04L2209/56

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,757,662
App. No.: 17/080,525
Granted: Sep 12, 2023
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Some embodiments provide systems and methods for confidentially and securely provisioning data to an authenticated user device. A user device may register an authentication public key with an authentication server. The authentication public key may be signed by an attestation private key maintained by the user device. Once the user device is registered, a provisioning server may send an authentication request message including a challenge to the user device. The user device may sign the challenge using an authentication private key corresponding to the registered authentication public key, and may return the signed challenge to the provisioning server. In response, the provisioning server may provide provisioning data to the user device. The registration, authentication, and provisioning process may use public key cryptography while maintaining confidentiality of the user device, the provisioning server, and then authentication server.

Claims (72)

1. A computer-implemented method comprising:

receiving, by a provisioning server, an authentication challenge from an authentication server;

sending, by the provisioning server, the authentication challenge to a user device;

receiving, by the provisioning server, an authentication response from the user device;

sending, by the provisioning server, the authentication response to the authentication server, wherein the authentication server authenticates the user device;

receiving, by the provisioning server, an indication of whether or not the authentication response is valid from the authentication server; and

in response to the authentication response being valid, sending, by the provisioning server, provisioning data to the user device.

2. The computer-implemented method of claim 1 , wherein receiving the authentication response from the user device further comprises:

3. The computer-implemented method of claim 2 , wherein the authentication response is encrypted using a first shared secret that is generated using a user device ephemeral private key and a provisioning server public key, and

the computer-implemented method further comprises:

generating, by the provisioning server, the first shared secret using a provisioning server private key and the user device ephemeral public key; and

decrypting, by the provisioning server, the encrypted authentication response using the first shared secret to obtain the authentication response.

4. The computer-implemented method of claim 3 , further comprising:

encrypting, by the provisioning server, the provisioning data with the first shared secret.

5. The computer-implemented method of claim 3 , further comprising:

blinding, by the provisioning server, the provisioning server public key to obtain a blinded provisioning server public key; and

sending, by the provisioning server, the blinded provisioning server public key to the user device, wherein the authentication response is encrypted using the blinded provisioning server public key.

6. The computer-implemented method of claim 1 , further comprising:

receiving a blinded user device public key; and

encrypting the authentication challenge using the blinded user device public key.

7. The computer-implemented method of claim 1 , further comprising:

encrypting, by the provisioning server, the provisioning data to obtain encrypted provisioning data; and

sending, by the provisioning server, the encrypted provisioning data to the user device.

8. The computer-implemented method of claim 1 , further comprising:

receiving, by the provisioning server, a user device ephemeral public key from the user device; and

encrypting, by the provisioning server, the authentication challenge using the user device ephemeral public key to obtain an encrypted authentication challenge, wherein sending the authentication challenge to the user device is accomplished by sending the encrypted authentication challenge.

9. The computer-implemented method of claim 1 , further comprising:

prior to sending the provisioning data, receiving, by the provisioning server, identification data from the user device; and

determining the provisioning data based on the identification data.

10. The computer-implemented method of claim 9 , wherein the identification data is received prior to receiving the authentication challenge, the method further comprising sending the identification data to the authentication server before receiving the authentication challenge.

11. A computer system, comprising:

a processor; and

a non-transitory computer-readable storage medium coupled to the processor and storing code executable by the processor for performing a method including:

receiving, by a provisioning server, an authentication challenge from an authentication server;

sending, by the provisioning server, the authentication challenge to a user device;

receiving, by the provisioning server, an authentication response from the user device;

sending, by the provisioning server, the authentication response to the authentication server, wherein the authentication server authenticates the user device;

receiving, by the provisioning server, an indication of whether or not the authentication response is valid from the authentication server; and

in response to the authentication response being valid, sending, by the provisioning server, provisioning data to the user device.

12. The computer system of claim 11 , wherein the method further includes:

generating, by the provisioning server, a provisioning server blinding factor; and

blinding, by the provisioning server, a provisioning server public key and a provisioning server private key with the provisioning server blinding factor to obtain a blinded provisioning server public key and a blinded provisioning server private key;

receiving, by the provisioning server, a blinded user device authentication public key from the user device; and

generating, by the provisioning server, an authentication shared secret using the blinded user device authentication public key and the blinded provisioning server private key.

13. The computer system of claim 12 , wherein the sending the authentication challenge to the user device further includes:

encrypting a provisioning server certificate with the provisioning server blinding factor to form an encrypted provisioning server certificate;

encrypting, by the provisioning server, the authentication challenge with the authentication shared secret to form an encrypted authentication challenge; and

sending, by the provisioning server, the encrypted provisioning server certificate and the encrypted authentication challenge to the user device.

14. The computer system of claim 11 , wherein the method further includes:

receiving, by the provisioning server, a user device ephemeral public key from the user device;

generating, by the provisioning server, a shared secret using a provisioning server private key and the user device ephemeral public key; and

encrypting, by the provisioning server, the provisioning data with the shared secret.

15. The computer system of claim 11 , wherein the receiving the authentication response from the user device further includes:

receiving, by the provisioning server, an encrypted authentication response and a user device ephemeral public key from the user device, the encrypted authentication response being generated by the user device by encrypting the authentication response, wherein the authentication response is encrypted using a first shared secret that is generated using a user device ephemeral private key and a provisioning server public key, and

the method further includes:

generating, by the provisioning server, the first shared secret using a provisioning server private key and the user device ephemeral public key; and

decrypting, by the provisioning server, the encrypted authentication response using the first shared secret to obtain the authentication response.

16. The computer system of claim 15 , wherein the method further includes:

blinding, by the provisioning server, the provisioning server public key to obtain a blinded provisioning server public key; and

sending, by the provisioning server, the blinded provisioning server public key to the user device, wherein the authentication response is encrypted using the blinded provisioning server public key.

17. The computer system of claim 11 , wherein the method further includes:

receiving a blinded user device public key; and

encrypting the authentication challenge using the blinded user device public key.

18. The computer system of claim 11 , wherein the method further includes:

receiving, by the provisioning server, a user device ephemeral public key from the user device; and

19. The computer system of claim 11 , wherein the method further includes:

prior to sending the provisioning data, receiving, by the provisioning server, identification data from the user device; and

determining the provisioning data based on the identification data.

20. The computer system of claim 19 , wherein the identification data is received proper to receiving the authentication challenge, and

the method further includes sending the identification data to the authentication server before receiving the authentication challenge.

Continuity (3)

Continuation 15577898

Provisional Application 62187125 · Jun 30, 2015

Related Publication 20210058259A1 · Feb 25, 2021

Cited By (4)

US 12,192,377 US 12,244,739 US 12,375,304 US 12,506,623