# US 11,115,394 B2 · Methods and systems for encrypting data for a web application

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,115,394 B2
- Document ID: US11115394B2
- Status: Granted
- Kind: B2
- Application number: 16/507,130
- Filed: 2019-07-10
- Published: 2020-01-16
- Granted: 2021-09-07
- Earliest claimed: 2018-07-11
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Rupesh Salgaonkar; Anup Yedalawar; Amit Paliwal; Abhinandan Patil; Rahul Prakash Kurde
- Web page: https://patentgrep.com/patent/US11115394B2

## CPC

- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/162: {at the data link layer}
- H04L 63/166: {at the transport layer}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Embodiments provide methods, and systems for encrypting data for web aplication. A method includes receiving, by a server system, a cryptographic certificate including asymmetric key pair. The method includes generating a random value key that forms at least a part of a Content Encryption Key (CEK) to be generated by a web application. The method includes sending the random value key to a client device running the web application over a secure network communication channel for generating the CEK. The CEK is to be utilized for encrypting a content entered by a user of the web application on the client device and the CEK is encrypted using a public key of the asymmetric key pair for transmission over the secure network communication channel. Furthermore, the method includes translating, the CEK encrypted under public key to CEK encrypted under LMK using a private key being part of the asymmetric key pair.

## Claims

### Claim 1

A computer-implemented method, comprising:
generating, by a server system, a cryptographic certificate, the cryptographic certificate comprising an asymmetric key pair;
generating, by the server system, a random value key, the random value key forming at least a part of a Content Encryption Key (CEK) to be generated by a web application;
sending, by the server system, the random value key to a client device running the web application over a secure network communication channel for generating the CEK, wherein the CEK is to be utilized for encrypting a content entered by a user of the web application on the client device and wherein the CEK is encrypted using a public key being part of the asymmetric key pair for transmission over the secure network communication channel; and
translating, by the server system, the CEK encrypted under the public key to CEK encrypted under a Local Master Key (LMK) using a private key, the private key being part of the asymmetric key pair.

### Claim 2 (depends on 1)

The method as claimed in claim 1, wherein the private key is encrypted under the LMK of a Hardware Security Module (HSM).

### Claim 3 (depends on 1)

The method as claimed in claim 1, wherein the random value key is a sixteen byte long key.

### Claim 4 (depends on 1)

The method as claimed in claim 1, wherein the secure network communication channel is established according to at least one of: a Secure Socket Layer (SSL) protocol; and a Transport Layer Security (TLS) protocol.

### Claim 5 (depends on 1)

The method as claimed in claim 1, further comprising:
sending the cryptographic certificate to the client device for retrieval of the public key being part of the asymmetric key pair; and
validating the cryptographic certificate prior to retrieving the public key.

### Claim 6 (depends on 5)

The method as claimed in claim 5, wherein the cryptographic certificate is validated based on one or more parameters, the one or more parameters comprising:
validity of a start date and an end date of the cryptographic certificate;
validity of a certificate chain up to a subordinate certificate authority;
validity of certificate extension, a certificate revocation list (CRL), an Online Certificate Status Protocol (OCP), and a key usage frequency; and
validity of a distributed name.

### Claim 7 (depends on 1)

The method as claimed in claim 1, wherein the CEK is generated by the web application at the client device by randomly selecting a predefined length key from a hash value of an intermediate key, wherein the hash value is generated using a hashing algorithm and wherein the predefined length key is 16 byte long.

### Claim 8 (depends on 7)

The method as claimed in claim 7, wherein the intermediate key is generated by concatenating a self-generated key with the random value key, the self-generated key formed by the web application at the client device.

### Claim 9 (depends on 8)

The method as claimed in claim 8, wherein the self-generated key is 16 byte long.

### Claim 10 (depends on 1)

The method as claimed in claim 1, further comprising:
generating a content offset using the CEK encrypted under the LMK and content encrypted under the LMK.

### Claim 11 (depends on 10)

The method as claimed in claim 10, wherein the content offset is matched with an original content entered by the user of the web application for validation.

### Claim 12 (depends on 1)

The method as claimed in claim 1, wherein the content is a Personal Identification Number (PIN) of a payment card.

### Claim 13 (depends on 1)

The method as claimed in claim 1, wherein the server system is a payment server of a payment network, and wherein the content includes at least one of a login ID, a password, a Card Verification Value (CVV) and a payment related data.

### Claim 14

A server system, the server system comprising:
a communication interface configured to establish a secure network communication channel with a client device running a web application;
a memory comprising executable instructions;
a hardware security module (HSM) configured to
generate a cryptographic certificate, the cryptographic certificate comprising an asymmetric key pair comprising a public key and a private key,
generate a random value key forming at least a part of a Content Encryption Key (CEK) to be generated by the web application, and
translate the CEK encrypted under the public key to CEK encrypted under a Local Master Key (LMK) using the private key; and
a processor communicably coupled to the communication interface, the processor configured to execute the instructions to cause the server system to at least send the random value key to the client device running the web application over the secure network communication channel for generating the CEK, wherein the CEK is to be utilized for encrypting a content entered by a user of the web application on the client device and wherein the CEK is encrypted using the public key of the asymmetric key pair for transmission over the secure network communication channel.

### Claim 15 (depends on 14)

The server system as claimed in claim 14, wherein the private key is encrypted under the LMK of the HSM.

### Claim 16 (depends on 14)

The server system as claimed in claim 14, wherein the secure network communication channel is established according to at least one of: a Secure Socket Layer (SSL) protocol; and a Transport Layer Security (TLS) protocol.

### Claim 17 (depends on 14)

The server system as claimed in claim 14, wherein the server system is further caused to:
send the cryptographic certificate to the client device for retrieval of the public key being part of the asymmetric key pair; and
validate the cryptographic certificate prior to retrieving the public key.

### Claim 18 (depends on 17)

The server system as claimed in claim 17, wherein the cryptographic certificate is validated based on one or more parameters, the one or more parameters comprising:
validity of a start date and an end date of the cryptographic certificate;
validity of a certificate chain up to a subordinate certificate authority;
validity of certificate extension, a certificate revocation list (CRL), an Online Certificate Status Protocol (OCP), and a key usage frequency; and
validity of a distributed name.

### Claim 19 (depends on 14)

The server system as claimed in claim 14, wherein the CEK is generated by the web application at the client device by randomly selecting a predefined length key from a hash value of an intermediate key, wherein the hash value is generated using a hashing algorithm and wherein the predefined length key is a 16 byte long key.

### Claim 20

A computer-implemented method, comprising: generating, by a web application running on a client device, a self-generated key;
concatenating the self-generated key with a random value key to generate an intermediate key, the random value key received from a server system; creating a hash value of the intermediate key using a hashing algorithm;
generating a CEK by randomly selecting a predefined length key from the hash value of the intermediate key;
encrypting a content under the CEK;
encrypting the CEK using a public key being part of an asymmetric key pair for transmission over a secure network communication channel to the server system, wherein the public key is retrieved from a cryptographic certificate sent by the server system which generates the asymmetric key pair using a Hardware Security Module (HSM), and the server system translates the CEK encrypted under the public key to CEK encrypted under a Local Master Key (LMK) using a private key of the asymmetric key pair.