Granted Patent B2

US 12,335,412 · App. 17/353,556 · Granted Jun 17, 2025

Inventors: Kevin Osborn (Newton Highlands, MA); Samuel Patrick Edwards (Richmond, VA)

Assignee: Capital One Services, LLC

H04L9/3271H04L9/30H04L63/0435H04L63/0492H04L9/14

Abstract

Claims (56)

1. An authentication server, comprising:

a processor; and

a memory,

wherein the processor:

transmits an authentication request;

receives a first response that is responsive to the authentication request, the first response comprising a first cryptogram;

generates a first challenge based on the first response;

encrypts the first challenge with a symmetric key;

generates a secret salt that is associated with a transaction;

transmits the first challenge after it has been encrypted and transmits the secret salt along with the encrypted first challenge;

receives a second response that is responsive to the first challenge, the second response comprising a second cryptogram, wherein the second cryptogram is generated using the first challenge in combination with one or more private card keys, and comprises the secret salt;

authenticates the second response by:

decrypting the second cryptogram, and

validating the decrypted second cryptogram using a session key by comparing the secret salt from the second cryptogram with a reference secret salt; and

transmits, to a client device, one or more authentication messages as a result of the validation of the decrypted second cryptogram.

2. The authentication server of claim 1 , wherein the first response is generated based on a first read of a tag.

3. The authentication server of claim 2 , wherein the first read of the tag includes a read of a tag of a contactless card and the first response includes a version number associated with the contactless card.

4. The authentication server of claim 1 , wherein the first challenge is associated with a first predetermined time duration.

5. The authentication server of claim 4 , wherein the processor generates, after expiration of the first predetermined time duration, a second challenge associated with a second predetermined time duration.

6. The authentication server of claim 1 , wherein the processor generates the first challenge based on a determination of a predetermined type of transaction.

7. The authentication server of claim 1 , wherein the processor receives a public key and a version number.

8. The authentication server of claim 7 , wherein the first challenge is transmitted based on the version number.

9. A method of authentication, the method comprising the steps of:

transmitting an authentication request;

receiving a first response that is responsive to the authentication request, the first response comprising a first cryptogram;

generating a first challenge based on the first response;

encrypting the first challenge with a symmetric key;

generating a secret salt that is associated with a transaction;

transmitting the first challenge after it has been encrypted and transmitting the secret salt along with the encrypted first challenge;

receiving a second response that is responsive to the first challenge, the second response comprising a second cryptogram, wherein the second cryptogram is generated using the first challenge in combination with one or more private card keys, and comprises the secret salt;

authenticating the second response by:

decrypting the second cryptogram, and

validating the decrypted second cryptogram using a session key by comparing the secret salt from the second cryptogram with a reference secret salt; and

transmitting, to a client device, one or more authentication messages as a result of the validation of the decrypted second cryptogram.

10. The method of claim 9 , wherein the first response is generated based on a first read of a tag.

11. The method of claim 10 , wherein the first read of the tag includes a read of a tag of a contactless card and the first response includes a version number associated with the contactless card.

12. The method of claim 9 , wherein the first challenge is associated with a first predetermined time duration.

13. The method of claim 12 , further comprising generating, after expiration of the first predetermined time duration, a second challenge associated with a second predetermined time duration.

14. The method of claim 9 , further comprising generating the first challenge based on a determination of a predetermined type of transaction.

15. The method of claim 9 , further comprising receiving a public key and a version number.

16. The method of claim 15 , wherein the first challenge is transmitted based on the version number.

17. The method of claim 9 , further comprising decrypting the second response including the secret salt.

18. The method of claim 9 , further comprising transmitting, based on determining an outcome of decryption status of the second cryptogram, one or more messages indicative of the decryption status.

19. The method of claim 9 , wherein the first cryptogram is received via a near field communication data exchange format (NDEF) read.

20. A computer readable non-transitory medium comprising computer executable instructions that, when executed on a processor, perform procedures comprising the steps of:

transmitting an authentication request;

receiving a first response that is responsive to the authentication request, the first response comprising a first cryptogram;

generating a first challenge based on the first response;

encrypting the first challenge with a symmetric key;

generating a secret salt that is associated with a transaction;

transmitting the first challenge after it has been encrypted and transmitting the secret salt along with the encrypted first challenge;

receiving a second response that is responsive to the first challenge, the second response comprising a second cryptogram, wherein the second cryptogram is generated using the first challenge in combination with one or more private card keys, and comprises the secret salt;

authenticating the second response by:

decrypting the second cryptogram, and

validating the decrypted second cryptogram using a session key by comparing the secret salt from the second cryptogram with a reference secret salt; and

transmitting, to a client device, one or more authentication messages as a result of the validation of the decrypted second cryptogram.

Assignments (1)

Continuity (1)

References Cited (400)