# US 12,008,558 B2 · Systems and methods for cryptographic authentication of contactless cards

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,008,558 B2
- Document ID: US12008558B2
- Status: Granted
- Kind: B2
- Application number: 17/511,225
- Filed: 2021-10-26
- Published: 2022-03-24
- Granted: 2024-06-11
- Earliest claimed: 2018-10-02
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Kevin Osborn; James Ashfield; Srinivasa Chigurupati; Jeffrey Rule
- Web page: https://patentgrep.com/patent/US12008558B2

## CPC

- G06Q 20/3829: {involving key management}
- G06Q 20/108: {Remote banking, e.g. home banking}
- G06Q 20/12: specially adapted for electronic shopping systems
- G06Q 20/204: {comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit}
- G06Q 20/3226: {Use of secure elements separate from M-devices}
- G06Q 20/341: {Active cards, i.e. cards including their own processing means, e.g. including an IC or chip}
- G06Q 20/343: {Cards including a counter}
- G06Q 20/352: {Contactless payments by cards}
- G06Q 20/3825: {Use of electronic signatures}
- G06Q 20/40975: {using encryption therefor}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3271: {using challenge-response}
- G06Q 2220/00: Business processing using cryptography
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Example embodiments of systems and methods for data transmission between a contactless card and a client device in support of a FIDO authentication are provided. In an embodiment, upon receipt of a challenge issued by a server in connection with a pending transaction, the contactless card may authorize the client device to utilize a FIDO private key to respond to the challenge. If the response to the challenge is successful, the FIDO authentication may proceed and the transaction may be completed.

## Claims

### Claim 1

A method, comprising:
receiving, by a client application comprising instructions for execution on a client device, a verification from a contactless card, wherein:
the verification permits the use of a Fast Identity Online (FIDO) private key, and
the client device comprises a processor, a memory, and a communication interface;
generating, by the client application using a master key and a diversified key, a FIDO key pair including the FIDO private key and a FIDO public key; and
signing, by the client application, a challenge using the FIDO private key.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
receiving, by the client application, the challenge from a server; and
transmitting, by the client application, a verification request to the contactless card.

### Claim 3 (depends on 2)

The method of claim 2, further comprising transmitting, by the client application, the signed challenge to the server.

### Claim 4 (depends on 3)

The method of claim 3, further comprising transmitting, by the client application, the FIDO public key to the server.

### Claim 5 (depends on 3)

The method of claim 3, wherein:
the memory of the client device stores identification information, and
the client application is further configured to generate the FIDO key pair using the identification information with the master key and the diversified key.

### Claim 6 (depends on 5)

The method of claim 5, wherein the identification information comprises a site identifier for a website.

### Claim 7 (depends on 6)

The method of claim 6, wherein the server is associated with the website.

### Claim 8 (depends on 1)

The method of claim 1, further comprising storing, by the client application, the FIDO private key in the memory of the client device.

### Claim 9

A system, comprising:
a processor in data communication with a memory,
wherein the processor is configured to:
receive a verification permitting the use of a Fast Identity Online (FIDO) private key;
generate, using a master key and a diversified key, a FIDO key pair including the FIDO private key and a FIDO public key; and
sign a challenge using the FIDO private key.

### Claim 10 (depends on 9)

The system of claim 9, wherein the processor is further configured to:
receive the challenge from a server;
transmit a verification request to a contactless card; and
transmit the signed challenge to the server.

### Claim 11 (depends on 9)

The system of claim 9, wherein the challenge is created by the FIDO public key.

### Claim 12 (depends on 9)

The system of claim 9, wherein the processor is further configured to receive a verification input prior to signing the challenge using the FIDO private key.

### Claim 13 (depends on 9)

The system of claim 9, wherein:
the memory stores a counter, and
the processor is further configured to generate the diversified key using the master key and the counter.

### Claim 14 (depends on 13)

The system of claim 13, wherein the processor is further configured to receive the counter from a server.

### Claim 15 (depends on 9)

The system of claim 9, wherein the challenge comprises a string of random characters.

### Claim 16

A non-transitory memory storing a client application, a master key, and a diversified key, wherein:
the client application comprises instructions for execution on a client device comprising a processor, a memory, and a communication interface, and
the client application is configured to:
receive a verification permitting the use of a Fast Identity Online (FIDO) private key;
generate, using a master key and a diversified key, a FIDO key pair including the FIDO private key and a FIDO public key; and
sign a challenge using the FIDO private key.

### Claim 17 (depends on 16)

The non-transitory memory of claim 16, wherein the client application is further configured to:
receive the challenge from a server;
transmit a verification request to a contactless card; and
transmit the signed challenge to the server.

### Claim 18 (depends on 17)

The non-transitory memory of claim 17, wherein:
the non-transitory memory stores identification information, and
the client application is further configured to generate the FIDO key pair using the identification information with the master key and the diversified key.

### Claim 19 (depends on 18)

The non-transitory memory of claim 18, wherein:
the identification information comprises a site identifier for a website, and
the server is associated with the website.

### Claim 20 (depends on 16)

The non-transitory memory of claim 16, wherein the application is further configured to transmit the FIDO public key to a server.