# US 10,769,299 B2 · System and method for dynamic generation of URL by smart card

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,299 B2
- Document ID: US10769299B2
- Status: Granted
- Kind: B2
- Application number: 16/034,229
- Filed: 2018-07-12
- Published: 2020-01-16
- Granted: 2020-09-08
- Earliest claimed: 2018-07-12
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Jeffrey Rule; Wayne Lutz; Paul Moreton; Kevin Osborn
- Web page: https://patentgrep.com/patent/US10769299B2

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/35: communicating wirelessly
- G06K 19/0723: {the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs}
- G06Q 20/326: {Payment applications installed on the mobile devices}
- G06Q 20/3278: {RFID or NFC payments by means of M-devices}
- G06Q 20/352: {Contactless payments by cards}
- G06Q 20/382: {insuring higher security of transaction}
- G06Q 20/3821: {Electronic credentials}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/126: {the source of the received data}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Embodiments of a smart card and systems and methods for secure data access using a smart card are described. The smart card may be formed a substrate and may include a microprocessor, a memory containing an applet, a counter, and a unique identifier. The smart card may dynamically generate a unique uniform resource location (URL) and transmit the URL to via a contactless communication interface to securely facilitate data access from other devices.

## Claims

### Claim 1

A smart card comprising:
a substrate;
a memory embedded in the substrate, wherein the memory contains an applet, a counter, and a unique customer identifier;
a contactless communication interface embedded in the substrate; and
a microprocessor embedded in the substrate,
wherein the microprocessor is in data communication with the memory and the contactless communication interface,
wherein, after entry of the contactless communication interface into a communication field of a communication device, the microprocessor increments the counter and synchronizes the value of the counter with a second counter stored in the communication device,
wherein the applet generates a unique one-time uniform resource locator (URL) by cryptographically hashing the incremented value of the counter and the unique customer identifier,
wherein the unique one-time URL is transmitted to the communication device via the contactless communication interface, and
wherein the communication device synchronizes the incremented value of the second counter value with a third counter stored in a server prior to the transmission of the unique one-time URL.

### Claim 2 (depends on 1)

The system for the secure access of information of claim 1, wherein prior to sending financial information to the client application, the server requests entry of authentication information on the client application.

### Claim 3 (depends on 2)

The system for the secure access of information of claim 2, wherein the server requests entry of authentication information based on the sensitivity of the financial information.

### Claim 4 (depends on 2)

The system for the secure access of information of claim 2, wherein the authentication information is at least one of a password, fingerprint scan, and a facial scan.

### Claim 5 (depends on 1)

The system for the secure access of information of claim 1, wherein the client application appends information identifying itself to the unique one-time URL transmitted to the server.

### Claim 6 (depends on 5)

The system for the secure access of information of claim 5, wherein the server declines to send financial information to the client application based on the identifying information appended to the unique one-time URL by the client application.

### Claim 7 (depends on 1)

The system for the secure access of information of claim 1, wherein the client application appends location information to the unique one-time URL transmitted to the server.

### Claim 8 (depends on 1)

The system for the secure access of information of claim 1, wherein the communication device is placed in a fixed location and the client application appends information relating to its location to the unique one-time URL transmitted to the server.

### Claim 9 (depends on 1)

The system for the secure access of information of claim 1, wherein the client application is located in a commercial location and the client application appends information relating to the commercial location to the unique one-time URL transmitted to the server.

### Claim 10 (depends on 9)

The system for the secure access of information of claim 9, wherein, upon receipt of the unique one-time URL, the server provides location-specific data to the client application based on the information appended to the unique one-time URL.

### Claim 11 (depends on 1)

The system for the secure access of information of claim 1, wherein the client application displays the financial information received from the server in one of a browser or a second application.

### Claim 12 (depends on 1)

The system for the secure access of information of claim 1, wherein the contactless communication interface is configured to support at least one of near field communication and a body area network.

### Claim 13

A system for the secure access of information, comprising:
a server containing financial information;
a smart card including a microprocessor, a contactless communication interface, and a memory storing an applet, a counter, and a unique customer identifier; and
a client application comprising instructions for execution on a communication device having a communication field,
wherein after entry of the contactless communication interface into the communication field:
the microprocessor is configured to increment a value stored in the counter and synchronize the incremented counter value with the client application,
the applet is configured to generate a unique one-time uniform resource locator (URL) by cryptographically hashing the incremented value of the counter and the unique customer identifier, and
the contactless communication interface is configured to transmit the unique one-time URL to the client application;
wherein the client application synchronizes the incremented counter value with the server prior to transmitting the unique one-time URL;
wherein upon receipt of the unique one-time URL, the client application opens the unique one-time URL to display financial information received from the server, and
wherein the server recreates the cryptographic hash using the incremented value of the counter value prior to the display of financial information by the client application.

### Claim 14

A method of accessing of information, the method comprising:
bringing a smart card containing a contactless communication interface, a microprocessor, and a memory storing an applet, a counter, and a unique customer identifier, into the communication field of a communication device;
incrementing a value stored in the counter and synchronizing the value with a counter contained in the communication device;
synchronizing the incremented counter value with a counter contained in the server;
generating a unique one-time uniform resource locator (URL) by cryptographically hashing the incremented counter value and the unique customer identifier;
transmitting the unique one-time URL to a client application comprising instructions for execution on the communication device via the contactless communication interface;
appending location information relating to the communication device to the unique URL;
transmitting the unique one-time URL to a server containing financial information;
recreating the cryptographic hash by the server using an expected counter value and the unique customer identifier;
comparing the cryptographic hash recreated by the server to the unique one-time URL transmitted to the server; and
transmitting financial information from the server to the client application if the recreated cryptographic hash matches the unique one-time URL.

### Claim 15 (depends on 14)

The method of accessing of information of claim 14, wherein the communication device is in a commercial location and the appended information relates to the commercial location.

### Claim 16 (depends on 14)

The method of accessing of information of claim 14, further comprising receiving location-specific data from the server in response to the appended location information.

### Claim 17 (depends on 14)

The method of accessing of information of claim 14, further comprising entering at least one of a password, fingerprint scan, or facial scan prior to receiving financial information from the server.

### Claim 18 (depends on 14)

The method of accessing of information of claim 14, further compromising appending information identifying the communication device to the unique one-time URL before transmitting the unique one-time URL to the server.

### Claim 19 (depends on 18)

The method of accessing of information of claim 18, wherein upon review of the information identifying the communication device appended to the unique one-time URL by the server, requesting additional authentication information prior to transmitting financial information from the server to the communication device.