Granted Patent B2

US 12,341,897 · App. 18/222,857 · Granted Jun 24, 2025

Inventors: Jeffrey Rule (Chevy Chase, MD); Srinivasa Chigurupati (Long Grove, IL); Kevin Osborn (Newton Highlands, MA)

Assignee: Capital One Services, LLC

H04L9/3234H04L9/0866H04L9/14H04L9/3228H04L9/3242

Abstract

Claims (37)

1. A cryptographic system, comprising:

a contactless card including a processor, and a memory, wherein the memory contains a first applet, a second applet, and a plurality of keys,

wherein the first applet is configured to receive, from the second applet, one or more requests to encrypt one or more payload strings using the plurality of keys to perform one or more cryptographic operations,

wherein the plurality of keys are rotated based on an index, and

wherein the first applet is configured to perform, after a detection of an intrusion, the one or more cryptographic operations on behalf of the second applet based on the one or more requests.

2. The cryptographic system of claim 1 , further comprising:

a server comprising a server processor and a server memory, the server memory containing the plurality of keys,

wherein the server is configured to rotate the plurality of keys based on a security rule.

3. The cryptographic system of claim 2 , wherein the security rule comprises rotating the plurality of keys in a random sequence.

4. The cryptographic system of claim 2 , wherein the security rule comprises rotating the plurality of keys in a predetermined sequence.

5. The cryptographic system of claim 2 , wherein the security rule comprises rotating the plurality of keys in a predetermined sequence.

6. The cryptographic system of claim 5 , wherein the predetermined sequence is based on a declaration table.

7. The cryptographic system of claim 5 , wherein: each of the plurality of keys is assigned an odd number or an even number, and the predetermined sequence selects between odd numbers and even numbers.

8. The cryptographic system of claim 5 , wherein: each of the plurality of keys is assigned a prime number or a non-prime number, and the predetermined sequence selects between prime numbers and non-prime numbers.

9. The cryptographic system of claim 2 , wherein the contactless card is configured to transmit the index to the server.

10. The cryptographic system of claim 1 , further comprising:

a server comprising a server processor and a server memory, the server memory containing the plurality of keys,

wherein the server is configured to:

receive, from the contactless card via one or more intermediary devices, a cryptogram,

match one key of the plurality of keys to a key used by the contactless card, and

decrypt, using the matched key, the cryptogram.

11. The cryptographic system of claim 5 , wherein the contactless card is configured to transmit the index to the server.

12. The cryptographic system of claim 11 , wherein the server is configured to, prior to matching one key of the plurality of keys to the key used by the contactless card, rotate the plurality of keys based on the index.

13. The cryptographic system of claim 10 , wherein the matched key is the same as the key used by the contactless card to generate the cryptogram.

14. A method performed by a contactless card including a processor, and a memory, wherein the memory contains a first applet, a second applet, and a plurality of keys, the method comprising:

receiving one or more requests to encrypt one or more payload strings using the plurality of keys to perform one or more cryptographic operations;

rotating the plurality of keys are rotated based on an index; and

performing, after a detection of an intrusion, the one or more cryptographic operations on behalf of the second applet based on the one or more requests.

15. The method of claim 14 , further comprising invalidating, after the detection of the intrusion, one or more of the plurality of keys.

16. The method of claim 14 , further comprising, terminating, after the detection of the intrusion, the first applet.

17. A computer readable non-transitory medium comprising computer-executable instructions for a first applet that are executed on a processor and comprise the steps of:

receiving one or more requests to encrypt one or more payload strings using the plurality of keys to perform one or more cryptographic operations;

rotating the plurality of keys are rotated based on an index; and

performing, after a detection of an intrusion, the one or more cryptographic operations on behalf of a second applet based on the one or more requests.

18. The computer readable non-transitory medium of claim 17 , wherein the first applet and the second applet belong to a security domain.

19. The computer readable non-transitory medium of claim 17 , wherein the first applet belongs to a first security domain and the second applet belongs to a second security domain.

20. The computer readable non-transitory medium of claim 17 , wherein the first applet communicates with the second applet via a secure tunnel.

Assignments (1)

Continuity (5)

References Cited (400)