Contactless card personal identification system

This application claims priority to US patent application Ser. The contents of the above application are hereby incorporated by reference in their entirety.

Credit card cloning, or "skimming," is a technique in which a malicious actor copies credit card information from a credit card associated with an account to a counterfeit card. Cloning is typically accomplished by running a credit card through a skimmer to extract ("skim") the credit card information from the card's magnetic stripe and storing the information on the counterfeit card. Counterfeit cards can be used to charge accounts.

EMV (originating from Europay, Mastercard, Visa) defines standards for the use of smart payment cards and the terminals and automated teller machines that accept them.

An EMV card is a smart card (ie chip card or IC (integrated circuit) card) that includes an integrated circuit configured to store card information in addition to magnetic stripe information (for backwards compatibility). EMV cards include both cards that are physically inserted (or "dipped") into a reader, and contactless cards that can be read over short distances using Near Field Communication (NFC) technology. include.

Some EMV cards use chip and PIN (personal identification number) technology to overcome problems associated with cloning. For example, to authorize a transaction, a user may enter a personal identification number (PIN) at a transaction terminal following a card swipe. The PIN retrieved from the card and stored by the transaction terminal is compared with the PIN input and the transaction is authorized only if the two match. While such a solution may reduce fraud, it remains vulnerable to PIN interception caused by eavesdropping, man-in-the-middle, or other types of attacks.

According to one aspect of the present invention, a multi-factor authentication system, apparatus and method combine a personal identification number (PIN) verification procedure with a contactless card authentication process to reduce the potential for losses due to card cloning.

According to one aspect, a method for two-factor authentication for a request for access to an account associated with a client includes receiving an input PIN from a user interface; fitting; sending the input PIN to the contactless card; receiving a cipher from the contactless card if the input PIN matches the stored PIN; sending the cipher to an authentication device; and granting the request once the cipher is authenticated by the authenticator, the cipher being formed using a dynamic key of the contactless card, the dynamic key representing a counter value held by the contactless card. The cipher contains contactless card data encoded using a dynamic key.

According to another aspect, a method for two-factor authentication for a request for access to an account associated with a client includes receiving an input PIN from a user interface. The method further includes inserting a contactless card that stores a PIN associated with the client. The method further includes receiving a cipher from the contactless card, the cipher formed using a dynamic key of the contactless card, the dynamic key formed using a counter maintained by the contactless card. and the cipher contains the contactless card data, including the PIN, and is encoded using a dynamic key. The method further includes transmitting the input PIN and encryption to the authentication device. The method further includes authorizing the request once the input PIN and encryption are authenticated by the authenticator.

According to a further aspect, an apparatus includes: a contactless card interface configured to communicate with a contactless card associated with a client; a user interface; a processor; and a non-volatile memory having code. The program code, when executed by the processor, is adapted to transmit an input PIN received by the user interface to a contactless card and receive a cryptographic code from the contactless card upon a match between the input PIN and the stored PIN. It is operable. The cipher is formed using the contactless card's dynamic key, the dynamic key is formed using a counter value held by the contactless card, and the cipher is a non-contact encrypted using the dynamic key . Contains contact card data. The program code may further be operable to send the cipher to the authenticator and grant the request once the cipher is authenticated by the authenticator.

<figref num="1A">1 is a block diagram of a data transmission system configured to provide multi-factor authentication of customer requests using a personal identification number (PIN), according to an exemplary embodiment; FIG.</figref><figref num="1B">FIG. 10 is a dataflow diagram illustrating one embodiment of a sequence for providing authenticated access using data stored on a contactless card.</figref><figref num="2A">1 illustrates one embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="2B">1 illustrates one embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="3A">4 illustrates an alternative embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="3B">4 illustrates an alternative embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="4A">4 illustrates an alternative embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="4B">4 illustrates an alternative embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="5A">4 illustrates an alternative embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="5B">4 illustrates an alternative embodiment of the system and method for two-factor PIN-based authentication disclosed herein.</figref><figref num="6">1B is an example of a contactless card for storing authentication information that may be used in the system of FIG. 1A;</figref><figref num="7">4 is a block diagram showing exemplary components that may be included in the contactless card of FIG. 3; FIG.</figref><figref num="8">[0012] Figure 4 illustrates exemplary domains of cryptography that may be used as part of a PIN exchange as disclosed in various embodiments herein.</figref><figref num="9">1B is a detailed block diagram of components of the system of FIG. 1A that may be utilized to support aspects of the present invention; FIG.</figref><figref num="10">4 illustrates prompts that may be provided by a user interface of a client device according to one embodiment disclosed herein.</figref>

Data security and transaction integrity are extremely important to businesses and consumers. This need continues to grow as electronic transactions constitute an ever-greater proportion of commercial activity and malicious actors become more and more aggressive in attempting to compromise transaction security.

Embodiments of the present disclosure provide systems, methods and apparatus for multi-factor authentication of transactions received at a client device using a personal identification number (PIN) in combination with a contactless card.

A contactless card may include a substrate that includes memory that stores one or more applets, counter values, and one or more keys. In some embodiments, the memory may also store a PIN that controls use of the contactless card, as described herein. In one embodiment, the counter value may be used to generate a unique cipher that can be used to authenticate contactless card transactions. Cryptography may be used in conjunction with PINs to provide two-factor authentication for contactless card transactions.

Cryptography is disclosed in U.S. Patent Application Serial No. 16/205,119 (hereinafter "'119 application"). In some embodiments, a cipher may be formed from a cryptographic hash of a shared secret, multiple keys, and a counter value.

According to one aspect, cryptography may be used with the PIN to provide multi-factor authentication for contactless card transactions. Multi-factor authentication may involve verifying the user's knowledge of the card's PIN prior to or as part of authenticating a transaction using cryptography. In some embodiments, a cipher may be formed using a PIN. In some embodiments, the cipher may include an encoded PIN. In either case, the PIN is never transmitted in an identifiable form, thereby maintaining transaction security and thus reducing the possibility of theft. Such a measure of using a PIN together with cryptography for two-factor authentication provides protection against cloning of contactless cards by unauthorized third parties.

In some embodiments, PIN verification may be performed by the card as a prerequisite to cryptography generation. In other embodiments, PIN verification may be performed by the transaction device or backend authentication server as part of cryptographic authentication. Each of these methods is described in more detail below.

Of course, the functions of PIN storage, encryption, and authentication may be performed by various components in various systems, including clients, client devices, and authentication servers of various embodiments. In some embodiments, a copy of the PIN may be kept in the contactless card's memory. In such embodiments, a copy of the PIN may be used to verify the contactless card user as part of the cryptographic authentication process. In some embodiments, a PIN may be used to generate a digital signature or cipher. In some embodiments, cryptographic authentication may be performed by a transaction device, an authentication server, or some combination thereof.

Thus, the system provides two-factor authentication that establishes both knowledge (i.e., PIN number) and possession (i.e., contactless card and dynamic key), allowing malicious actors to The ability to replicate successfully can be reduced.

These and other features of the invention will now be described with reference to the drawings. Here, like reference numerals are used to refer to like elements throughout. With general reference to the notation and nomenclature used herein, the detailed description that follows can be presented in terms of program processes running on a computer or network of computers. These process descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art.

A process is considered here, and generally, to be a self-consistent sequence of operations leading to a desired result. These operations require physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals capable of being stored, transmitted, combined, compared, and otherwise manipulated. It proves convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these terms and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to those quantities.

Further, the operations performed are often referred to in terms such as addition or comparison, commonly associated with mental operations performed by human operators. In most cases, such capabilities of a human operator are neither necessary nor desirable in any of the operations described herein forming part of one or more embodiments. Rather, this operation is a machine operation. Useful machines for performing the operations of various embodiments include general purpose digital computers or similar devices.

Various embodiments also relate to apparatuses or systems for performing these operations. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer as selectively activated or reconfigured by a computer program stored in the computer. The processes presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose machines may be used with programs written in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. good. The required structure for a variety of these machines will appear from the description provided.

Reference is now made to the drawings. Like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding thereof. It may be evident, however, that new embodiments may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing the same. The intention is to cover all modifications, equivalents, and alternatives consistent with the claimed subject matter.

FIG. 1A shows a data transmission system according to an exemplary embodiment. System 100 may include contactless card 105, client device 110, network 115, and server 120, as discussed further below. Although FIG. 1A shows a single example of components, system 100 may include any number of components.

System 100 may include one or more contactless cards 105 . In one embodiment, the contactless card 105 is a credit card sized card that includes an embedded integrated circuit, a storage device, and an interface that allows the card to communicate with a sending device using the Near Field Communication (NFC) protocol. Including card. Contactless cards that can be used herein include, for example, the contactless cards described in the '119 application.

System 100 may include client device 110 . Client device 110 may be a network-enabled computer. As referred to herein, a network-enabled computer may be, for example, a server, network appliance, personal computer, workstation, telephone, handheld PC, personal digital assistant, thin client, fat client, Internet browser, or other device. may include, but are not limited to, a computer device including, but not limited to, a communication device. Client device 110 may also be a mobile device. For example, the mobile device may be an Apple® iPhone®, iPod®, iPad®, or any other mobile device running Apple®'s iOS operating system; Any device running Microsoft's Windows® mobile operating system, any device running Google's Android® operating system, and/or other smart phones, tablets, or similar wearable mobile devices may contain.

The client device 110 may include a processor and memory, and the processing circuitry includes processors, memory, error and parity/CRC checkers, data encoders, anti-collision algorithms, and the necessary functions to perform the functions described herein. It is understood that additional components may be included including controllers, command decoders, security primitives and tamper resistant hardware. Client device 110 may further include a display and input device. The display may be any type of device for presenting visual information such as computer monitors, flat panel displays, and mobile device screens, including liquid crystal displays, light emitting diode displays, plasma panels, and cathode ray tube displays. . An input device is any device for entering information into a user device that may be available and supported by the user device, such as a touch screen, keyboard, mouse, cursor control device, touch screen, microphone, digital camera, video recorder or camcorder. device. These devices may be used to enter information and interact with the software and other devices described herein.

In some examples, client device 110 of system 100 may be one or more applications, such as software applications that enable network communication with one or more components of system 100 to send and/or receive data. may be executed.

Client devices 110 may communicate with one or more servers 120 via one or more networks 115 and may operate with servers 120 as respective front-end and back-end pairs. Client device 110 may send one or more requests to server 120 , eg, from a mobile device application running on client device 110 . One or more requests may relate to obtaining data from server 120 . Server 120 may receive one or more requests from client device 110 . Based on one or more requests from client device 110, server 120 may be configured to retrieve the requested data from one or more databases (not shown). Upon receipt of the requested data from the one or more databases, server 120 may be configured to send the received data to client device 110 in response to the one or more requests.

System 100 may include one or more networks 115 . In some examples, network 115 may be one or more of a wireless network, a wired network, or any combination of wireless and wired networks, and is configured to connect client device 110 to server 120. may be For example, network 115 may include fiber optic networks, passive optical networks, cable networks, Internet networks, satellite networks, wireless local area networks (LANs), global systems for mobile communications, personal communication services, personal area networks, wireless application protocols, multi Media message service, extended message service, short message service, systems based on time division multiplexing, systems based on code division multiple access, D-AMPS, Wi-Fi, fixed wireless data, IEEE802.11b, 802.15. 1, 802.11n and 802.11g, Bluetooth®, NFC, Radio Frequency Identification (RFID), Wi-Fi®, and the like.

Additionally, network 115 may include, but is not limited to, global networks such as telephone lines, fiber optics, IEEE Ethernet 902.3, wide area networks, wireless personal area networks, LANs, or the Internet. Additionally, network 115 may support an Internet network, a wireless communication network, a cellular network, etc., or any combination thereof. Network 115 may further include one network, or any number of the aforementioned exemplary types of networks, operating as a stand-alone network or operating in cooperation with each other. Network 115 may utilize one or more protocols of one or more network elements with which they are communicatively coupled. Network 115 may translate to or from other protocols to one or more protocols of network devices. Although network 115 is depicted as a single network, in accordance with one or more examples, network 115 can include, for example, the Internet, service provider networks, cable television networks, corporate networks such as credit card association networks, and It should be appreciated that it may include multiple interconnected networks, such as a home network.

System 100 may include one or more servers 120 . In some examples, server 120 may include one or more processors coupled to memory. Server 120 may be configured as a central system, server, or platform for controlling and invoking different data at different times to perform multiple workflow operations. Server 120 may be configured to connect to one or more databases. Server 120 may be connected to at least one client device 110 . In some embodiments, server 120 may be an authentication server configured to perform cryptographic authentication as disclosed herein.

FIG. 1B is a timing diagram illustrating an exemplary sequence for authenticating contactless card transactions in accordance with one or more embodiments of the present disclosure; In particular, FIG. 1B describes an exemplary process for exchanging authentication data, including encryption, between contactless card 105 and client device 110. FIG. System 100 may include contactless card 105 and client device 110 that may include application 122 and processor 124 . FIG. 1B may refer to similar components as shown in FIG. 1A.

At step 102, application 122 communicates with contactless card 105 (eg, after being carried near contactless card 105). Communication between application 122 and contactless card 105 is accomplished by connecting contactless card 105 to a card reader (not shown) of client device 110 to enable NFC data transmission between application 122 and contactless card 105 . ).

In step 104, after communication is established between client device 110 and contactless card 105, contactless card 105 generates a message authentication code (MAC) cipher. In some examples, this may occur when contactless card 105 is read by application 122 . In particular, this may be done upon reading, such as NFC reading, of Near Field Data Exchange (NDEF) tags that may be generated according to the NFC data exchange format. For example, a reader such as application 122 may send a message such as an applet selection message with the applet ID of the NDEF-generated applet. Once the selection is confirmed, a read file message may be sent following the sequence of selected file messages. For example, a sequence may include "select feature file", "load feature file", and "select NDEF file". At this point, the counter value maintained by the contactless card 105 may be updated or incremented, after which "read NDEF file" may be sent. At this point, a message may be generated that includes a header and shared secret.

A session key may then be generated. In one embodiment, the variant key may be generated by using a cryptographic hash to combine the master symmetric key with a dynamic counter value maintained by the contactless card. Examples of cryptographic hash algorithms that may be used include symmetric encryption algorithms, HMAC algorithms, and CMAC algorithms. Non-limiting examples of symmetric algorithms that may be used to encrypt the username and/or cipher are symmetric encryption algorithms such as 3DES (Triple Data Encryption Algorithm) or AES (Advanced Encryption Standard) 128, HMAC - May include symmetric hash-based message authentication (HMAC) algorithms such as SHA-256 and symmetric cipher-based message authentication code (CMAC) algorithms such as AES-CMAC. It is understood that many forms of encryption are known to those skilled in the art, and the present disclosure is not limited to the forms specifically identified herein.

A MAC cipher may be generated from a message, and the message may include a header and a shared secret. In some embodiments, shared information, including but not limited to a shared secret and/or PIN, is then concatenated with one or more blocks of random data and encoded using a cryptographic algorithm and variant key. , may generate a MAC cipher. The MAC cipher and header may then be concatenated, encoded as ASCII hex, and sent back in the NDEF message format (response to the "read NDEF file" message).

In some examples, the MAC cipher may be sent as an NDEF tag, and in other examples the MAC cipher may be included (eg, as a formatted string) with a uniform resource indicator.

In some examples, application 122 may be configured to send a request to contactless card 105, the request including instructions to generate a MAC cipher.

At step 106 , contactless card 105 transmits the MAC encryption to application 122 . In some examples, transmission of the MAC cipher is done by NFC, although the disclosure is not so limited. In other examples, this communication may be by Bluetooth®, Wi-Fi®, or other means of wireless data communication.

At step 108 , application 122 communicates the MAC cipher to processor 124 .

At step 112 , processor 124 verifies the MAC cipher according to instructions from application 122 . For example, the MAC cipher may be verified by an authentication server, such as server 120 of FIG. 1A. The authentication server may store a copy of the client device counter, shared secret, and key for each client device 110 . In some embodiments, the authentication server may store the PIN associated with the client device, as described in more detail below. The authorization server may update the counter for each contactless card transaction according to a protocol established between the client device 110 and the authorization server so that the counters remain synchronized. The authentication server may use copies of counters, keys, shared secrets and/or PINs to construct a predictive MAC cipher.

In some examples, a MAC cipher may serve as a digital signature for verification purposes. Other digital signature algorithms such as public key asymmetric algorithms, eg, digital signature algorithms, RSA algorithms, or zero-knowledge protocols may be used to perform this verification.

The authentication server may compare the MAC cipher received from the contactless card with the expected MAC cipher generated by the authentication server. Such measures improve the security of transactions in a number of ways. First, the dynamic nature of the cipher, built using variable counter values that are periodically updated according to a protocol established between the client and server, prevents malicious third parties from exposing authentication information. Decrease the ability to reuse. Second, the use of cryptographic algorithms also prevents eavesdropping from discovering confidential information. Third, incorporating PIN code verification along with cryptographic authentication adds a knowledge modifier for two-factor authentication.

Figures 2A and 2B illustrate the respective systems and processes of one embodiment of a two-factor authentication system configured to support authentication methods that use PINs in conjunction with and/or as part of cryptography.

In system 200 of FIG. 2A, transaction device 222 (which may be a client mobile device, merchant transaction device, or any device with NFC communication capabilities) receives information from user 202, such as an input PIN. It can be seen that it includes a user interface 225 for Transaction device 222 also supports network communication including, but not limited to, Internet Protocol (IP) communication with authentication server 223 and NFC interface 220 configured to support NFC communication with contactless card 205. It can be seen that it includes a network interface 227 configured to:

According to one aspect, the contactless card 205 includes PIN matching logic 210 that matches the PIN stored in the memory of the contactless card with the PIN received from the transaction device 222, eg, as part of an NDEF record. It may include hardware, software, or a combination thereof configured to compare. Card 205 also includes cipher generation logic 211 configured to generate ciphers, such as those disclosed in the '119 application.

Cryptographic logic 211 may comprise a combination of hardware and software components, including a storage device configured to store one or more keys and counter values for card 205. , but not limited to. The contactless card further includes counters, encryption and/or hashing hardware and software, etc. for use in generating modified dynamic keys for use in encoding messages from the contactless card. may contain. In some embodiments, cryptographic logic 211 may be implemented, at least in part, as an applet stored in memory of contactless card 205 . Although PIN logic 210 and encryption logic 211 are shown separately, it is understood that functionality may be distributed differently in various embodiments. For example, in some embodiments PIN logic 210 and encryption logic 211 may be implemented by a single applet.

It can be seen that server 223 includes cryptographic verification logic 228 . Cryptographic verification logic 228 may comprise a combination of hardware and software components, including storage devices for storing client keys and counter values, counters, encryption and/or hashing hardware, and Including, but not limited to, software. In one embodiment, the cipher verification logic 228 may be configured to generate a modified dynamic key for use in generating the expected cipher, the verification logic combining the expected cipher with the cipher received from the client device. may be compared. A cryptographic match indicates equivalence between the client device's counter and the authentication server. Additionally, matching ciphers can indicate knowledge of information such as shared secrets, PINs, and the like.

FIG. 2B shows a method for two-factor authentication using the system of FIG. 2A. At step 251 a transaction is initiated by user 202 . For example, a user may attempt to access an account, make a purchase, or perform any action that would benefit from the two-factor authentication methods disclosed herein. At step 252, the user 202 is prompted to enter a PIN, and upon receiving the input PIN, the transaction device 222 taps the card 205 on the transaction device 222 or is within communication range with the transaction device 222, for example. A double authenticated cryptographic exchange with contactless card 205 may be initiated by prompting the user to bring contactless card 205 inside.

When the contactless card is within range of the transaction device, at step 253 the transaction device 222 transmits the input PIN, eg, as a PIN record, to the contactless card 205 to read the NFC tag associated with the crypto-generating applet. issue an order. At step 254 , PIN matching logic 210 may compare the input PIN with stored PIN 215 . If a "match" is determined at step 255 , the cipher generator applet is instructed to generate a cipher and send the cipher to transaction device 222 at step 256 .

If the cipher is not received at step 257 , eg due to a PIN mismatch, the transaction may be canceled at step 259 . If the cipher was received at step 257 , transaction device 222 requests authentication of the transaction and transmits the cipher to authentication server 223 at step 258 .

At step 260 , once the authentication server 223 receives the encryption, it obtains client data, including counters, keys, shared secrets, etc. associated with the contactless card 205 . Using this information, in step 261 the authentication server generates an expected cipher and in step 262 determines whether the generated cipher matches the unique digital signature provided by the received cipher. to decide. At step 263 , the authorization server returns an accept/deny response to transaction device 222 . If transaction device 222 determines in step 264 that the transaction is authorized, then in step 265 the transaction may be executed. If the transaction is declined, the transaction device cancels the transaction at step 250 .

The disclosed two-factor PIN-based authentication system improves transaction security by protecting the stored PIN 215 from discovery. As discussed, stored PINs are not publicly transmitted and thus cannot be obtained by malicious surveillance during PIN exchanges. If the PIN, shared secret and/or counter value can be obtained by skimming, cloned cards without knowledge of the dynamic counter protocol implemented between the card and the authentication server will be rendered inoperable.

3A and 3B disclose another embodiment of a two-factor PIN-based authentication system and method. Here, PIN verification functionality may be provided by authentication server 323 as part of cryptographic verification logic 328 . In system 300 of FIG. 3A, card 305 stores a unique PIN 315 for contactless cards and configures cryptographic logic 311, which may include cryptographic generation applets as previously described. According to one embodiment, as described in more detail below, the encryption provided by contactless card 305 may include and/or be formed using PIN 315 .

Transaction device 322 includes user interface 325 , NFC interface 320 and network interface 327 . Additionally, the transaction device may include encapsulation logic 324 . Encapsulation logic 324 , in one embodiment, may include code for encrypting the input PIN and/or cipher before sending the input PIN/cipher pair to authentication server 323 .

Authentication server 323 includes cryptographic verification logic 328 . Cryptographic verification logic 328 may operate to extract the input PIN from the encrypted input PIN/cipher pair. Cipher verification logic 328 may also be configured to generate expected ciphers using the input PIN and stored client data such as counters and key data. Cipher verification logic 328 may then compare the predicted cipher to the extracted cipher to determine a match that correlates with the input PIN and the stored PIN, as well as counter and key information.

FIG. 3B is a flow diagram of a two-factor authentication process that may be performed by system 300. As shown in FIG. After the transaction is initiated at step 351, user 302 is prompted for an input PIN at step 352. At step 353, the cryptographic authentication process is initiated as described above, for example, transaction device 322 is configured to obtain PIN 315 from contactless card 305 for inclusion in card 305's NDEF tag generation applet, specifically the cryptographic payload. It may issue an NFC read operation to the NDEF tag generation applet. In step 356, the contactless card applet may construct cryptographic data in the form &lt;user ID&gt;&lt;counter&gt;&lt;user ID+counter+MAC of PIN&gt;. In some embodiments, a variant key formed using a counter may be used to encode &lt;user ID+counter+MAC of PIN&gt; using a cryptographic hash algorithm or the like. Public-key asymmetric algorithms, such as digital signature and RSA algorithms, or zero-knowledge protocols may alternatively be used to perform this verification.

Contactless card 305 returns the cipher to transaction device 322, and in step 354 transaction device 322 combines the input PIN with the received cipher. In some embodiments, the input PIN and/or the received cipher may be encrypted, eg, using a symmetric encryption algorithm, to obfuscate the input PIN information. This combination is sent to authentication server 323 .

At step 360, the authentication server 323 retrieves authentication information (including counter values, keys, shared secrets, etc.) for the contactless card from storage. Using this information, in step 361 the authentication server may construct a prospective cipher, for example in the form &lt;MAC of user ID+stored counter+input PIN&gt;. At step 362, the authorization server determines whether the expected cipher matches the cipher obtained from the contactless card, and returns an authorization status to transaction device 322 at step 363. Upon receipt of authorization status at step 364 , the transaction is executed at step 364 or canceled at step 359 .

Thus, in the embodiment of Figures 3A and 3B, the encryption generated by the contactless card is formed using the PIN, but the PIN itself is not transmitted over the network in identifiable or derivable form.

4A and 4B disclose another embodiment of a two-factor PIN-based authentication system and method. Here, the PIN verification may be performed by the transaction device using public key cryptography. In one embodiment, contactless card 405 holds private key 417 . Private key 417 is known only to contactless card 405 and may be used to decrypt communications encrypted by the public key. The contactless card may further include digital signature logic 411 configured to generate a unique digital signature, cryptographic hash, to provide cryptography for communications to transaction device 422 .

Transaction device 422 includes user interface 425 and NFC interface 420 . The transaction device is also shown to include a random number generator 454, cryptographic logic 424, and memory 455 that stores the public key 457 for the contactless card. Here, the public key may be obtained by the transaction device from a trusted certificate authority. The transaction device further includes digital signature logic 456 for generating digital signatures, as described below. In some embodiments, the card's 405 public key may be stored by the card 405 and read by the transaction device as part of the authentication process.

FIG. 4B shows a method of two-factor authentication using the system 400 of FIG. 4A. If step 461 determines that the transaction has been initiated, then in step 462 user 404 is prompted to enter an input PIN. At step 463, the transaction device obtains the public key for the contactless card either from the card itself or from a trusted certificate authority. At step 465 , the transaction device generates a random number, encrypts it with its public key, and sends it to contactless card 405 . At step 466, the contactless card decrypts the random number using its private key and generates a digital signature using the combination of the random number and the stored PIN 415. The resulting digital signature is sent back to transaction device 422 .

At step 467, transaction device 422 also uses the random number in combination with the input PIN received from user 402 to generate a digital signature. At step 468, the digital signatures are compared to identify matches. Depending on the match status, the transaction is executed at step 470 (match) or canceled at step 469 (not match).

5A and 5B disclose another embodiment of a two-factor PIN-based authentication system and method. Here, the contactless card PIN is stored in an authentication server and used in combination with cryptography to authenticate the transaction. In system 500 of FIG. 5A, contactless card 505 includes cryptographic logic 511 for generating cryptography using a combination of counters, dynamic keys, shared secrets, etc., as previously described. Transaction device 522 includes user interface 520 , NFC interface 525 and network interface 527 . Additionally, the transaction device may include encapsulation logic 524 . Encapsulation logic 524 , in one embodiment, may include code for encrypting the input PIN and/or cipher before sending the input PIN/cipher pair to authentication server 523 . Authentication server 523 includes PIN table 595 , PIN verification logic 594 and cryptographic verification logic 596 .

FIG. 5B shows a method of two-factor authentication using the system 500 of FIG. 5A. Following initiation of the transaction in step 551 , user 502 is prompted for an input PIN in step 552 and transaction device 522 requests encryption from contactless card 505 in step 553 . At step 555 the contactless card generates a cipher and returns it to transaction device 5422 . At step 554 , the transaction device combines and encrypts the input PIN received from the user with the cipher from the contactless card and transmits to authentication server 523 . At step 560 , the authentication server obtains the PIN, counter and key for contactless card 505 . At step 561, the authentication server decrypts the message from transaction device 522, extracts the input PIN, and at step 562 compares the extracted input PIN with the expected input PIN obtained from the PIN table. At step 563 , authentication server 523 may also extract the code obtained from contactless card 505 . Authentication server 523 may construct a predictive cipher using stored keys, counters, and shared secrets stored by cryptographic verification logic. At step 564, the transaction device may compare the predicted cipher with the extracted cipher to determine a match. In response to the comparison, authorization server 523 returns an authorization status to the transaction device at step 565 . Upon receiving authorization status at step 566, the transaction is executed at step 568 (match) or canceled at step 567 (non-match).

Thus, various systems and methods for providing two-factor PIN-based authentication have been shown and described. Exemplary components that may be included in contactless cards, transaction devices, and/or authentication servers, along with and/or in place of components already described, to support the methods described herein are: Description will be made with reference to FIGS.

FIG. 6 shows a contactless card 600. FIG. This may include payment cards such as credit cards, debit cards, or gift cards, issued by service provider 605 . The identity of service provider 605 may be displayed on the front or back of card 600 . In some examples, contactless card 600 is not related to payment cards and may include, but is not limited to, identification cards. In some examples, the payment card may include a dual interface contactless payment card. The contactless card 600 may include a substrate 610, which may include a single layer or one or more laminates of plastics, metals, and other materials. Exemplary substrate materials include polyvinyl chloride, Including polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, the contactless card 600 may have physical characteristics that comply with the ID-1 format of the ISO/IEC7810 standard; otherwise, the contactless card complies with the ISO/IEC14443 standard. You may have However, it is understood that the contactless card 600 according to the present disclosure may have different characteristics and this disclosure does not require the contactless card to be implemented in a payment card.

Contactless card 600 may include identification information 615 displayed on the front and/or back of the card and contact pad 620 . Contact pad 620 may be configured to establish contact with other communication devices such as user devices, smartphones, laptops, desktops, or tablet computers. Contactless card 600 may also include processing circuitry, antennas, and other components not shown in FIG. These components may be located behind contact pads 620 or elsewhere on substrate 610 . Contactless card 600 may also include a magnetic stripe or tape, which may be placed on the back of the card (not shown in FIG. 6).

As shown in FIG. 7, contact pad 720 may include processing circuitry for storing and processing information, including microprocessor 730 and memory 735 . The processing circuitry includes processors, memory, error and parity/CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives and tamper-proof hardware necessary to perform the functions described herein. It is understood that additional components may be included, including:

Memory 735 may be read-only memory, write-once read-multiple memory, or read/write memory, such as RAM, ROM, and EEPROM, and contactless card 700 may include one or more of these memories. . Read-only memory may be factory programmable as read-only, or it may be programmable only once. One-time programmability provides the opportunity to write once and read many times. The write-once/read-multiple memory may be programmed after the memory chip leaves the factory. Once the memory is programmed, it cannot be rewritten, but may be read many times.

Memory 735 may be configured to store one or more applets 740 , one or more counters 745 and customer information 750 . According to one aspect, memory 735 may store PIN 777 .

The one or more applets 740 are associated with one or more respective service provider applications, such as Java® card applets, one or more pieces of software configured to run on one or more contactless cards. May contain applications. For example, an applet may include logic configured to generate a MAC cipher as described above. MAC ciphers, in some embodiments, include MAC ciphers formed using, at least in part, PIN information.

The one or more counters 745 may include numeric counters sufficient to store integers. The customer information 750 may include a unique alphanumeric identifier assigned to the contactless card 700 user and/or one or more keys that may be used together to distinguish the contactless card user from other contactless card users. may contain. In some examples, customer information 750 may include information identifying both the customer and the account assigned to the customer, and may further identify the contactless card associated with the customer's account.

Although the processors and memory elements of the foregoing exemplary embodiments were described with reference to contact pads, the disclosure is not so limited. These elements may be implemented external to the pad 720, or may be implemented completely separate therefrom, or in addition to the microprocessor 730 and memory 735 elements located within the contact pad 720. , may be implemented as further elements.

In some examples, the contactless card 700 may include one or more antennas 725 located within the contactless card 700 and around the processing circuitry 755 of the contact pads 720 . For example, one or more antennas may be integral with the processing circuitry and one or more antennas may be used with external booster coils. As another example, one or more antennas may be external to the contact pads 720 and processing circuitry.

As explained above, the contactless card 700 may be built on a software platform operable on a smart card or other device that includes program code, processing power and memory, such as a Java card. . An applet responds to one or more requests, such as a Near Field Data Exchange (NDEF) request from a reader, such as a mobile Near Field Communication (NFC) reader, with a cryptographically secure OTP encoded as an NDEF text tag. may be configured to generate an NDEF message containing:

FIG. 8 shows an example NDEF short record layout (SR=1) 800 according to an example embodiment. NDEF messages provide a standardized way for transaction devices to communicate with contactless cards. In some examples, an NDEF message may contain one or more records. The NDEF record 800 includes a header 802, which includes a start of message (MB) flag 803a, an end of message (ME) flag 803b, a chunk flag (CF) 803c, a short record (SR) flag 803d, and an ID length (IL) flag 803e. and a number of flags that define how the rest of the record, including the Type Name Format (TNF) field 803f, is to be interpreted. MB 803a and ME flags 803b may be set to indicate the respective first and last records of the message. CF 803c and IL flags 803e are related to the record, including whether the data can be "chunked" (data spread across multiple records in a message) or whether the ID type length field 808 can be relevant, respectively. provide information. The SR flag 803d may be set if the message contains only one record.

The TNF field 803f identifies the type of content it contains, as defined by the NFC protocol. These types are Empty, Well Known (data defined by the NFC Forum's Record Type Definition (RTD)), Multipurpose Internet Mail Extensions (MIME) [defined by RFC2046], and Fully Uniform Resource Identifier (URI) [defined by RFC3986]. defined], external (user-defined), unknown, unchanged [for chunks] and reserved.

Other fields of the NFC record include Type Length 804, Payload Length 806, ID Length 808, Type 810, ID 812, and Payload 814. The type length field 804 specifies the exact type of data found within the payload. Payload length 806 contains the length of the payload in bytes. A record may contain up to 4,294,967,295 bytes (or 2^32-1 bytes) of data. ID length 808 contains the length of the ID field in bytes. Type 810 identifies the type of data the payload contains. For example, for authentication purposes, Type 810 may indicate that payload 814 is a cipher formed at least in part using a personal identification number (PIN) retrieved from the contactless card's memory. The ID field 812 provides a means for external applications to identify the entire payload carried within the NDEF record. Payload 814 contains the message.

In some examples, data may first be stored on the contactless card by performing a STORE DATA (E2) under a secure channel protocol. This data includes not only the card's unique Personal User ID (pUID) and PIN, but also cryptographic data including initial keys, session keys, data encryption keys, random numbers and other values described in more detail below. may contain one or more of In other embodiments, the pUID and PIN may be pre-loaded into the contactless card prior to carrying the contactless card to the client. In some embodiments, the PIN may be selected by the client for the contactless card and written back to the contactless card after client verification using various stringent authentication methods.

FIG. 9 shows a communication system 900 in which one of the contactless card 910 and/or the authentication server 950 can store information that can be used during first factor authentication. As described with respect to FIG. 3, each contactless card may include a microprocessor 912 and memory 916 for customer information 919, including one or more unique identifying attributes such as identifiers, keys, random numbers, and the like. In one aspect, the memory further includes applet 917 operable when executed by microprocessor 912 to control the authentication process described herein. As previously mentioned, PIN 918 may be stored in memory 916 of card 910 and accessed by applets and/or as part of customer information 919 . Additionally, each card 910 may include one or more counters 914 and an interface 915 . In one embodiment, the interface operates NFC or other communication protocol.

The client device 920 includes a contactless card interface 925 for communicating with a contactless card and one or more other devices that enable the device 920 to communicate with service providers using various communication protocols such as those described above. network interface (not shown). The client device may further include a user interface 929 that allows communication between the service provider's applications and the user of the client device 920 . User interface 929 may include one or more of a keyboard or touch screen display. Client device 920 further includes processor 924 and memory 922 . Memory 922 stores information and program code that, when executed by the processor, controls the operation of client device 920, such as accessing and using service provider applications. includes a client-side application 923 that may be provided to the client by the service provider to facilitate . In one embodiment, client-side application 923 includes program code configured to transmit authentication information, including a PIN code, from contactless card 910 to one or more services provided by a service provider as described above. including. Client-side app 923 may be controlled via an application interface displayed on user interface 926 . For example, a user may select an icon, link, or other mechanism provided as part of the application interface to launch a client-side application to access application services. Here, part of the activation involves verifying the client using a cryptographic exchange.

In an exemplary embodiment, a cryptographic exchange includes a transmitting device having a processor and memory, the memory of the transmitting device containing a master key, transmitted data, and a counter value. The sending device communicates with a receiving device having a processor and memory, the memory of the receiving device containing the master key. The transmitting device generates a modified key using the master key and one or more cryptographic algorithms, stores the modified key in memory of the transmitting device, and encrypts the counter value using the one or more cryptographic algorithms and the modified key. encrypting to generate an encrypted counter value, encrypting transmission data using one or more encryption algorithms and a variant key to generate encrypted transmission data, encrypted counter value and encrypted transmission The data may be encrypted and transmitted to the receiving device. The receiving device generates a variant key based on the stored master key and the stored counter value, stores the variant key in memory of the receiving device, and uses one or more decryption algorithms and the variant key ( It may be configured to decrypt encrypted ciphers (including encrypted counters and encrypted transmission data). The receiving device may authenticate the sending device if the decrypted counter and the stored counter match. A counter may be incremented at each of the sending device and the receiving device for subsequent authentications, thereby providing a cryptographically-based dynamic authentication mechanism for sending/receiving device transactions.

As discussed in connection with FIG. 1A, client device 920 may be connected to various services of service provider 905 and managed by application server 906 . In the illustrated embodiment, the authentication server 950 and the application server 906 are shown as separate components, although it is understood that the application server may include all of the functionality described as being included in the authentication server. should be understood.

It can be seen that authentication server 950 includes a network interface 953 for communicating with members of the network over network 930 and a central processing unit (CPU) 959 . In some embodiments, the authentication server may include a non-transitory storage medium for storing a PIN table 952 containing PIN information for clients of service providers. Such information may include, but is not limited to, the client's username, the client's personal identifier, and the client's keys and counters. In one embodiment, the authentication server includes an authentication unit 954 for controlling cryptographic decryption and counter extraction, and a client counter value that can be used as described below to perform authentication in conjunction with the contactless card 910. and table 956. In various embodiments, the authentication server may further include a PIN table 952 configured to have an entry for each client/contactless card pair.

FIG. 10 shows an example of a client device 1000 with a display 1010 including a prompt window 1020 and an input section 1030. FIG. The prompt portion may display various prompts to guide the client through the authentication process, including, for example, the prompt "please swipe your card" to encourage movement of the card 805 towards the device 1000. As shown in Figure 10, the prompt may include instructions such as "Please enter your PIN" and provide a keyboard or other input mechanism to allow the user to enter the PIN. In some embodiments, following a successful card tap and PIN entry, the user may complete the transaction. For example, completing a charge, accessing sensitive data, accessing a specific person, etc.

Thus, a system and method of two-factor PIN-based authentication using encryption and PIN exchange for multi-factor authentication has been shown and described to reduce and/or eliminate the possibility of card cloning. .

As used herein, the terms "system," "component," and "unit" refer to computer-related entities, either hardware, a combination of hardware and software, software, or software in execution. It is intended to refer to, examples of which are described herein. For example, a component can be a process running on a processor, a processor, a hard disk drive, multiple storage drives, a non-transitory computer-readable medium (of optical and/or magnetic storage media), an object, an entity of execution, a thread of execution, It may be a program and/or computer, but is not limited to these. By way of example, both an application running on a server and the server may be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers. good too.

Further, components may be communicatively coupled to each other by various types of communication media to coordinate operation. This coordination may involve a one-way or two-way exchange of information. For example, a component may convey information in the form of signals communicated over a communication medium. Information may be implemented as signals assigned to various signal lines. In such assignments, each message may be a signal. However, further embodiments may employ data messages instead. Such data messages may be sent over various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

Some embodiments, along with their derivatives, may be described using the phrases "one embodiment" or "an embodiment." These terms mean that a particular feature, structure, or property described in connection with an embodiment is included in at least one embodiment. The appearances of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment. Moreover, unless otherwise noted, it is recognized that the features described above can be used together in any combination. Accordingly, features that are separately discussed may be employed in combination with each other, unless it is noted that those features are mutually exclusive.

With general reference to the notation and nomenclature used herein, the detailed description herein is presented in terms of functional blocks or units that can be implemented as program procedures running on a computer or network of computers. may be presented. These procedural descriptions and representations are used by those skilled in the art to most effectively convey the substance of their work to others skilled in the art.

A procedure is considered here, and generally, to be a self-consistent sequence of operations leading to a desired result. These operations require physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical, magnetic, or optical signals capable of being stored, transmitted, combined, compared, and otherwise manipulated. It proves convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like. It should be noted, however, that all of these terms and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to those quantities.

Further, the operations performed are often referred to in terms such as addition or comparison, commonly associated with mental operations performed by human operators. In most cases, such capabilities of a human operator are neither necessary nor desirable in any of the operations described herein forming part of one or more embodiments. Rather, this operation is a machine operation. Useful machines for performing the operations of various embodiments include general purpose digital computers or similar devices.

Some embodiments may be described using the terms "coupled" and "connected" along with their derivatives. These terms are not necessarily intended as synonyms for each other. For example, when some embodiments are described using the terms "connected" and/or "coupled" to indicate that two or more elements are in direct physical or electrical contact with each other. There is However, the term "coupled" may mean that two or more elements cooperate or interact with each other without being in direct contact with each other.

It should be emphasized that this summary of the disclosure is provided to enable the reader to quickly ascertain the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. Moreover, in the foregoing Detailed Description, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment. In the appended claims, the terms "including" and "in which" are used as the plain English equivalents of the respective terms "comprising" and "wherein", respectively. Further, the terms "first", "second", "third", etc. are used merely as labels and are not intended to impose numerical requirements on their subject.

What has been described above includes examples of the disclosed configurations. Of course, it is impossible to describe all possible combinations of components and/or methodologies, but those skilled in the art will recognize that many further combinations and permutations are possible. Accordingly, the novel constructions are intended to embrace all such alterations, modifications and variations that fall within the spirit and scope of the appended claims.