# US 12,010,238 B2 · Systems and methods for cryptographic authentication of contactless cards

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,238 B2
- Document ID: US12010238B2
- Status: Granted
- Kind: B2
- Application number: 17/892,999
- Filed: 2022-08-22
- Published: 2022-12-22
- Granted: 2024-06-11
- Earliest claimed: 2018-10-02
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Kevin Osborn; Jeffrey Rule; Srinivasa Chigurupati
- Web page: https://patentgrep.com/patent/US12010238B2

## CPC

- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/0822: {using key encryption key}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Example embodiments of systems and methods for data transmission between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device. The receiving device can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.

## Claims

### Claim 1

A contactless card, comprising:
a processor; and
a memory containing a first private key, a first public key, transmission data, and a counter value,
wherein the contactless card is configured to:
process the counter value using a first cryptographic algorithm and the first private key to yield a cryptographic result including the counter value,
encrypt the transmission data and the cryptographic result using a second cryptographic algorithm and the first public key to yield encrypted transmission data,
generate a second public key based on the first public key, and
transmit the encrypted transmission data and the second public key to a receiving device.

### Claim 2 (depends on 1)

The contactless card of claim 1, wherein the contactless card is further configured to:
sign the counter value using the first private key, and
encrypt the signed counter value using the first public key and the second cryptographic algorithm.

### Claim 3 (depends on 1)

The contactless card of claim 1, wherein the second public key is generated based on the first public key and the counter value.

### Claim 4 (depends on 1)

The contactless card of claim 1, wherein the first public key includes a signed certificate to authenticate an issuer of the first public key.

### Claim 5 (depends on 1)

The contactless card of claim 1, wherein the contactless card is further configured to, prior to transmitting the second public key, encrypt the second public key.

### Claim 6 (depends on 1)

The contactless card of claim 1, wherein the first cryptographic algorithm and the second cryptographic algorithm each include at least one of (i) an asymmetric encryption algorithm, (ii) a digital signature algorithm, (iii) an ElGamal encryption algorithm, (iv) an elliptical curve algorithm, or (v) a Paillier cryptosystem algorithm.

### Claim 7 (depends on 6)

The contactless card of claim 6, wherein the contactless card is configured to select the first cryptographic algorithm and the second cryptographic algorithm.

### Claim 8 (depends on 1)

The contactless card of claim 1, wherein the transmission data comprises activation data for the contactless card.

### Claim 9 (depends on 1)

The contactless card of claim 1, wherein the first private key is specific to the contactless card.

### Claim 10 (depends on 1)

The contactless card of claim 1, wherein the first private key is a global private key.

### Claim 11

A data transmission system, comprising:
a contactless card comprising:
a card processor, and
a card memory containing a first private key, a first public key, transmission data, and a card counter value, wherein the contactless card is configured to:
process the counter value using a first cryptographic algorithm and the first private key to yield a cryptographic result including the counter value,
encrypt the transmission data and the cryptographic result using a second cryptographic algorithm and the first public key to yield encrypted transmission data,
generate a second public key based on the first public key, and
transmit the encrypted transmission data and the second public key to a receiving device.

### Claim 12 (depends on 11)

The system of claim 11, further comprising:
an application comprising instructions for executing on a receiving device having a receiving device processor and a receiving device memory, the receiving device memory containing a second private key and a receiving device counter value, wherein, when executed on the receiving device, the application is configured to:
receive the encrypted transmission data and the second public key, decrypt the encrypted transmission data using the second private key and a third cryptographic algorithm to yield the transmission data and the cryptographic result, and
decrypt and validate the card counter value using the second public key and a fourth cryptographic algorithm.

### Claim 13 (depends on 12)

The system of claim 12, wherein:
the third cryptographic algorithm is the same as the second cryptographic algorithm, and
the fourth cryptographic algorithm is the same as the first cryptographic algorithm.

### Claim 14 (depends on 11)

The system of claim 11, wherein the card counter value comprises a one-time passcode.

### Claim 15 (depends on 11)

The system of claim 11, wherein the contactless card is further configured to:
sign the counter value using the first private key, and
encrypt the signed counter value using the first public key and the second cryptographic algorithm.

### Claim 16 (depends on 11)

The system of claim 11, wherein the second public key is generated based on the first public key and the counter value.

### Claim 17 (depends on 11)

The system of claim 11, wherein the contactless card is further configured to, prior to transmitting the second public key, encrypt the second public key.

### Claim 18

A method performed by a contactless card comprising a processor and a memory containing a first private key, a first public key, transmission data, and a counter value, the method comprising:
processing the counter value using a first cryptographic algorithm and the first private key to yield a cryptographic result including the counter value;
encrypting the transmission data and the cryptographic result using a second cryptographic algorithm and the first public key to yield encrypted transmission data;
generating a second public key based on the first public key; and
transmitting the encrypted transmission data and the second public key to a receiving device.

### Claim 19 (depends on 18)

The method of claim 18, further comprising:
signing the counter value using the first private key, and
encrypting the signed counter value using the first public key and the second cryptographic algorithm.

### Claim 20 (depends on 18)

The method of claim 18, wherein the second public key is generated based on the first public key and the counter value.