# US 12,113,901 B2 · Authentication device, system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,901 B2
- Document ID: US12113901B2
- Status: Granted
- Kind: B2
- Application number: 17/030,997
- Filed: 2020-09-24
- Published: 2021-06-17
- Granted: 2024-10-08
- Earliest claimed: 2019-10-31
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Simon Blythe
- Web page: https://patentgrep.com/patent/US12113901B2

## CPC

- H04L 9/321: {involving a third party or a trusted authority}
- H04L 9/0827: {involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04W 12/033: of the user plane, e.g. user's traffic
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The present invention relates to secure transmission and reception of electronic messages using an authentication device. The authentication device includes a light sensor that is used to scan a visual element displayed on a display of a user device in conjunction with an electronic message having an encrypted payload. The visual element encodes a unique identifier that the authentication device transmits to a server, receiving in response a cryptographic key stored in association with the unique identifier and usable to decrypt an encrypted payload of the electronic message. The authentication device can also generate encryption keys and corresponding unique identifiers suitable for encryption of payloads of electronic messages.

## Claims

### Claim 1

An authentication device comprising:
a light sensor;
a transmitter;
wherein the authentication device is configured to:
receive a unique identifier from a user device by sensing, with the light sensor, a visual element encoding the unique identifier that is displayed on a display of the user device;
transmit, to a server, the unique identifier;
receive, from the server, a cryptographic key corresponding to the unique identifier; and
transmit, with the transmitter to the user device, the cryptographic key for decryption of an electronic message corresponding to the unique identifier;
the authentication device further comprising:
a user input device for receiving biometric information and/or a secret code from a user, wherein the authentication device is configured to prevent transmission of the unique identifier to the server until a valid biometric information and/or a valid secret code is entered in the user input device.

### Claim 2 (depends on 1)

The authentication device of claim 1, wherein the transmitter is configured to establish a one way communication channel with the user device.

### Claim 3

An authentication device comprising:
a light sensor; and
a transmitter;
wherein the authentication device is configured to:
receive a unique identifier from a user device by sensing, with the light sensor, a visual element encoding the unique identifier that is displayed on a display of the user device;
transmit, to a server, the unique identifier;
receive, from the server, a cryptographic key corresponding to the unique identifier;
transmit, with the transmitter to the user device, the cryptographic key for decryption of an electronic message corresponding to the unique identifier;
receive a sender's identification by scanning a second visual element encoding the sender's identification that is displayed on the display of the user device; and
transmit, to the server, the sender's identification.

### Claim 4 (depends on 3)

The authentication device of claim 3, wherein the authentication device and the user device are paired.

### Claim 5

A computer-implemented method for encrypting an electronic message, comprising:
receiving a receiver's identification at an authentication device from a user device by sensing, with a light sensor of the authentication device, a visual element of the electronic message that is displayed on a display of the user device, the visual element encoding the receiver's identification;
generating, at the authentication device, a cryptographic key and a unique identifier;
transmitting, by the authentication device, the cryptographic key and the unique identifier to the user device for encryption of the electronic message;
transmitting, by the authentication device and over a secure channel, the cryptographic key, the unique identifier and the receiver's identification to a server;
receiving, by the user device, the cryptographic key and the unique identifier from the authentication device;
encrypting, by the user device and using the cryptographic key, a payload of the electronic message to generate an encrypted electronic message;
inserting, by the user device, a second visual element into the encrypted electronic message, the second visual element encoding the unique identifier; and
transmitting, by the user device, the encrypted electronic message to a receiver associated with the receiver's identification.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein transmitting the cryptographic key and the unique identifier to the user device is over a one way channel.

### Claim 7

A computer-implemented method for decrypting an electronic message, comprising:
(a) receiving a unique identifier from a user device by sensing, with a light sensor of an authentication device, a visual element of the electronic message that encodes the unique identifier and which is displayed on a display of the user device;
(b) transmitting the received unique identifier, by the authentication device, over a secure channel to a server;
(c) receiving, by the authentication device, a cryptographic key over the secure channel from the server, the cryptographic key corresponding to the unique identifier;
(d) transmitting, by the authentication device, the cryptographic key to the user device for decryption of the electronic message; and
before operation a) or operation b):
receiving, via a user input device of the authentication device, biometric information and/or a secret code from a user;
determining, by the authentication device, whether the biometric information and/or the secret code corresponds to an authorized user; and
in the negative, aborting the decryption of the electronic message.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, further comprising:
receiving, by the user device, the cryptographic key from the authentication device; and
decrypting an encrypted payload of the electronic message using the cryptographic key.

### Claim 9 (depends on 7)

The computer-implemented method of claim 7, further comprising:
receiving, by the server, the unique identifier from the authentication device;
identifying, in a database, a transaction block containing the unique identifier; and
transmitting, by the server and to the authentication device, the cryptographic key stored in the transaction block.