# US 12,112,322 B2 · Systems and methods for user authorization and access to services using contactless cards

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,112,322 B2
- Document ID: US12112322B2
- Status: Granted
- Kind: B2
- Application number: 17/501,884
- Filed: 2021-10-14
- Published: 2022-02-03
- Granted: 2024-10-08
- Earliest claimed: 2018-10-02
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Kaitlin Newman; Colin Hart; Jeffrey Rule; Lara Mossler; Sophie Bermudez; Michael Mossoba; Wayne Lutz; Charles Nathan Crank; Melissa Heng; Kevin Osborn; Kimberly Haynes; Andrew Cogswell; Latika Gulati; Sarah Jane Cunningham; James Ashfield
- Web page: https://patentgrep.com/patent/US12112322B2

## CPC

- G06Q 20/3829: {involving key management}
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- G06Q 20/326: {Payment applications installed on the mobile devices}
- G06Q 20/352: {Contactless payments by cards}
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.

## Claims

### Claim 1

A system, comprising:
a contactless card having a processor and memory, the memory of the contactless card containing a card key and transmission data;
an application comprising instructions for execution on a receiving device having a processor and memory, the memory of the receiving device containing an application key;
wherein the contactless card is configured to:
encrypt the transmission data using a cryptographic algorithm and the card key to yield encrypted transmission data, and
transmit the encrypted transmission data to the application; and
wherein the application is configured to:
decrypt the encrypted transmission data using the cryptographic algorithm and the application key;
authenticate a user identity associated with a user;
record information comprising at least one selected from the group of a time of authentication, a location of authentication, a type of contactless card, a type of receiving device, a movement of one or more entries into a communication field, and a timing of one or more entries into a communication field; and
after authenticating the user identity, access sensitive information.

### Claim 2 (depends on 1)

The system of claim 1, wherein the sensitive information comprises at least one selected from the group of academic information, financial information, and medical information.

### Claim 3 (depends on 1)

The system of claim 1, wherein:
the sensitive information comprises insurance information, and
the application is further configured to transmit the insurance information to a device associated with a medical provider.

### Claim 4 (depends on 1)

The system of claim 1, wherein the application is further configured to, after authenticating the user identity and prior to accessing sensitive information, transmit a one-time passcode to a second device associated with the user.

### Claim 5 (depends on 4)

The system of claim 4, wherein the one-time passcode is time-limited.

### Claim 6 (depends on 1)

The system of claim 1, wherein:
the receiving device comprises a server, and
the contactless card is configured to transmit the encrypted transmission data to the application via one or more intermediary devices.

### Claim 7 (depends on 1)

The system of claim 1, wherein the application is further configured to:
analyze the recorded information, and
generate a user behavior profile.

### Claim 8 (depends on 7)

The system of claim 7, wherein:
the application is further configured to:
determine a threshold of variation for the user behavior profile, and
detect an indicator of fraud based on the user behavior profile, and
the indicator of fraud includes behavior outside of the user behavior profile and beyond the threshold of variation.

### Claim 9

A method, comprising:
encrypting, by a contactless card comprising a processor and a memory, the memory of the contactless card containing a card key and transmission data the transmission data using a cryptographic algorithm and the card key to yield encrypted transmission data, and
transmitting, by the contactless card, the encrypted transmission data to an application comprising instructions for execution on a receiving device having a processor and a memory, the memory of the receiving device containing an application key;
decrypting, by the application, the encrypted transmission data using the cryptographic algorithm and the application key;
authenticating, by the application, a user identity associated with a user;
recording, by the application, information comprising at least one selected from the group of time of authentication, location of authentication, type of contactless card, type of receiving device, movement of one or more entries into a communication field, and timing of one or more entries into a communication field; and
accessing, by the application after authenticating the user identity, sensitive information.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
analyzing, by the application, the recorded information; and
generating, by the application, a user behavior profile.

### Claim 11 (depends on 10)

The method of claim 10, further comprising:
determining, by the application, a threshold of variation for the user behavior profile; and
detecting, by the application, an indicator of fraud based on the user behavior profile.

### Claim 12 (depends on 11)

The method of claim 11, wherein the indicator of fraud includes behavior outside of the user behavior profile and beyond the threshold of variation.

### Claim 13 (depends on 9)

The method of the claim 9, wherein:
the sensitive information comprises financial information relating to an asset, and
the method further comprises, by the application, at least one selected from the group of buying the asset, selling the asset, and transferring the asset.

### Claim 14 (depends on 9)

The method of claim 9, wherein the method further comprises destroying, by the application, the sensitive information.

### Claim 15

A non-transitory computer-readable medium containing instructions for execution by the processor, wherein, upon execution by the processor, the instructions configure the processor to perform procedures comprising:
receiving, from a contactless card, encrypted transmission data;
decrypting, using a cryptographic algorithm and an application key, the transmission data;
authenticating a user identity associated with a user;
recording information comprising at least one selected from the group of time of authentication, location of authentication, type of contactless card, type of receiving device, movement of one or more entries into a communication field, and timing of one or more entries into a communication field; and
after authenticating the user identity, accessing sensitive information.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the sensitive information comprises at least one selected from the group of academic information, financial information, and medical information.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the procedures further comprise, after authenticating the user identity and prior to accessing sensitive information, transmitting, by the application, a one-time passcode to a smartphone associated with the user.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the procedures further comprise modifying the sensitive information.

### Claim 19 (depends on 1)

The system of claim 1, wherein the application is further configured to modify the sensitive information.

### Claim 20 (depends on 9)

The method of claim 9, wherein the sensitive information comprises at least one selected from the group of historical information and technical information.