Granted Patent B2

US 12,375,304 · App. 17/710,587 · Granted Jul 29, 2025

Inventor: Eric Le Saint (Los Altos, CA)

Assignee: Visa International Service Association

H04L9/3273H04L9/0844H04L9/0869H04L9/14H04L9/3242H04L9/3265H04L9/3268H04L63/0428H04L63/0442H04L63/061H04L63/0869H04L9/50H04L2209/04H04L2209/08H04L2209/56

Abstract

Claims (75)

1. A computer-implemented method for performing communications between a first computer and second computer, the method comprising performing, by the second computer:

receiving a first message including a first computer blinded public key and first encrypted authentication information from the first computer, wherein the first computer blinded public key is generated by the first computer using a first computer blinding factor and a first computer public key;

in response to receiving the first message, generating a first shared secret using the first computer blinded public key and a second computer private key;

decrypting the first encrypted authentication information using the first shared secret to obtain first authentication information of the first computer;

authenticating the first computer using the first authentication information;

in response to the authenticating of the first computer, encrypting second authentication information of the second computer to obtain second encrypted authentication information, the encrypting of the second authentication information based on the second computer private key and the first computer public key; and

sending a second message including the second encrypted authentication information to the first computer, thereby enabling the first computer to authenticate the second computer using the second authentication information,

wherein the first authentication information includes the first computer blinding factor and the first computer public key, and

wherein authenticating the first computer further comprises:

applying the first computer blinding factor to the first computer public key to obtain a generated blinded public key; and

comparing the generated blinded public key to the first computer blinded public key.

2. The method of claim 1 , wherein the second computer performs the encrypting of the second authentication information using the first shared secret, thereby enabling the first computer to decrypt the encrypted second authentication information and authenticate the second computer based on the second computer performing the encrypting of the second authentication information using the first shared secret.

3. The method of claim 1 , wherein the first authentication information includes the first computer public key, and wherein authenticating the first computer includes comparing the first computer public key to one or more stored computer public keys to identify a matching computer public key.

4. The method of claim 1 , wherein the first authentication information includes a first timestamp of the first computer, and wherein authenticating the first computer includes comparing the first timestamp to a second timestamp of the second computer.

5. The method of claim 1 , wherein the first computer blinding factor is generated using a pseudo-random number generator, and wherein the first computer blinded public key is determined from the first computer blinding factor using an elliptic curve public key algorithm.

6. A computer-implemented method for performing communications between a first computer and second computer, the method comprising performing, by the first computer:

generating a first computer blinded public key using a first computer blinding factor and a first computer public key;

generating a first shared secret using a first computer private key corresponding to the first computer public key, the first computer blinding factor, and a second computer public key of the second computer;

encrypting first authentication information of the first computer using the first shared secret to obtain first encrypted authentication information;

sending, to the second computer, a first message including the first computer blinded public key and the first encrypted authentication information, thereby enabling the second computer to generate the first shared secret using the first computer blinded public key and a second computer private key corresponding to the second computer public key, to decrypt the first encrypted authentication information, and to authenticate the first computer using the first authentication information;

receiving a second message from the second computer, the second message including second encrypted authentication information;

in response to receiving the second message, decrypting the second encrypted authentication information based on the first computer private key and the second computer public key to obtain second authentication information of the second computer; and

authenticating the second computer using the second authentication information,

wherein the second authentication information includes the second computer public key, and

wherein authenticating the second computer further comprises comparing the second computer public key to one or more stored computer public keys to identify a matching computer public key.

7. The method of claim 6 , further comprising performing, by the first computer, communicating with the second computer in response to the authenticating of the second computer.

8. The method of claim 6 , further comprising performing, by the first computer:

generating, a second shared secret using the first computer private key, the first computer blinding factor, and a second computer blinded public key, wherein the second message included the second computer blinded public key, wherein the first computer performs the decrypting of the second encrypted authentication information using the second shared secret, wherein the second authentication information includes a second computer blinding factor; and

verifying the second computer blinded public key using the second computer blinding factor and the second computer public key, wherein the authenticating of the second computer is based on the verifying of the second computer blinded public key.

9. A computer-implemented method for performing communications between a first computer and a second computer, the method comprising performing, by the first computer:

receiving a first message including a second computer blinded public key from the second computer, wherein the second computer blinded public key is generated by the second computer using a second computer blinding factor and a second computer public key that corresponds to a second computer private key;

generating a first computer blinded public key using a first computer blinding factor and a first computer public key;

generating a first shared secret using a first computer private key corresponding to the first computer public key, the first computer blinding factor, and the second computer blinded public key;

sending a second message including the first computer blinded public key to the second computer, thereby enabling the second computer to generate the first shared secret using the first computer blinded public key, the second computer blinding factor, and the second computer private key corresponding to the second computer public key; and

communicating with the second computer using the first shared secret.

10. The method of claim 9 , further comprising performing, by the first computer:

generating a second shared secret using the second computer blinded public key and the first computer private key, wherein the first message further includes an encrypted second computer blinding factor and an encrypted second computer certificate from the second computer;

decrypting the encrypted second computer blinding factor using the second shared secret to obtain the second computer blinding factor;

decrypting the encrypted second computer certificate using the second shared secret to obtain a second computer certificate including the second computer public key; and

authenticating, by the first computer, the second computer blinded public key received from the second computer using the second computer blinding factor and the second computer public key,

wherein the sending of the second message to the second computer is in response to verifying of the second computer blinded public key.

11. The method of claim 10 , wherein verifying the second computer blinded public key received from the second computer further comprises performing, by the first computer:

generating a generated second computer blinded public key using the second computer public key of the second computer certificate and the second computer blinding factor; and

comparing the generated second computer blinded public key and the second computer blinded public key received from the second computer.

12. The method of claim 9 , further comprising performing, by the first computer:

receiving an encrypted second computer blinding factor remainder and an encrypted second computer certificate from the second computer;

generating a second shared secret using the second computer blinded public key and the first computer private key;

decrypting the encrypted second computer blinding factor remainder using a second session key to obtain a second computer blinding factor remainder;

decrypting the encrypted second computer certificate using the second shared secret to obtain a second computer certificate, the second computer certificate including the second computer public key; and

verifying the second computer blinded public key using the second computer blinding factor remainder, a counter value, and the second computer public key of the second computer certificate, wherein the second computer blinding factor is generated by the second computer using the counter value and the second computer blinding factor remainder.

13. The method of claim 12 , wherein the second session key is generated using the second shared secret, a first session identifier, and a second session identifier, the first session identifier is generated using a blinded first authentication public key, and wherein the second session identifier is generated using a blinded second authentication public key.

14. The method of claim 9 , further comprising performing, by the first computer:

receiving an encrypted challenge from the second computer;

generating a second shared secret using the second computer blinded public key and the first computer private key;

decrypting the encrypted challenge using the second shared secret to obtain a second computer challenge; and

verifying the second computer challenge received from the second computer using a stored challenge stored at the first computer.

15. The method of claim 9 , further comprising performing, by the first computer:

receiving an encrypted second computer blinding factor remainder and an encrypted second computer certificate from the second computer;

generating a second shared secret using the second computer blinded public key and the first computer private key;

decrypting the encrypted second computer blinding factor remainder using a second session key to obtain a second computer blinding factor remainder;

decrypting the encrypted second computer certificate using the second session key to obtain a second computer certificate including the second computer public key; and

verifying the second computer blinded public key using the second computer blinding factor remainder, a stored challenge, and the second computer public key of the second computer certificate, wherein the second computer blinding factor is generated by the second computer using a challenge and the second computer blinding factor remainder, wherein the first computer sends the challenge to the second computer, the challenge being the same as the stored challenge.

16. The method of claim 9 , further comprising performing, by the first computer, sending at least one of a first computer certificate, a counter, and a challenge to the second computer.

17. A computer-implemented method for performing communications between a first computer and second computer, the method comprising performing, by the second computer:

generating a second computer blinded public key using a second computer blinding factor and a second computer public key;

sending the second computer blinded public key to the first computer;

receiving a first computer blinded public key from the first computer, wherein the first computer generated the first computer blinded public key using a first computer blinding factor and a first computer public key;

generating a first shared secret using the first computer blinded public key, the second computer blinding factor, and a second computer private key corresponding to the second computer public key; and

communicating with the first computer using the first shared secret.

18. The method of claim 17 , further comprising performing, by the second computer:

obtaining a second counter, the second counter being the same as a first counter of the first computer;

generating the second computer blinding factor based on a counter value of the second counter;

generating a second computer blinding factor remainder based on the second computer blinding factor and the counter value;

encrypting the second computer blinding factor remainder using a second shared secret to obtain an encrypted second computer blinding factor remainder; and

sending the encrypted second computer blinding factor remainder to the first computer.

Continuity (4)

References Cited (112)