System and method for parallel manufacture and verification of one-time-password authentication cards

A non-transitory computer-readable medium comprising instructions for execution by a computer hardware arrangement, wherein upon execution of the instructions the computer hardware arrangement is configured to perform procedure comprising:

• distributing, via secure communication from an encryption service provider, a shared-secret master key to a personalization hardware security module (HSM) associated with a manufacturing entity and a validation HSM associated with a validating entity, wherein the manufacturing HSM and validation HSM are distinct and respectively store a first master key and a second master key;
• generating, by the personalization HSM, a unique secret identifier by encrypting a globally unique card identifier associated with a contactless card, with the shared-secret master key;
• storing the unique secret identifier in an embossing file on the contactless card during a personalization phase, wherein the embossing file further comprises the globally unique card identifier, a first unique key derived by encrypting the globally unique card identifier with the first master key, and a second unique key derived by encrypting the globally unique card identifier with the second master key;
• generating, by the contactless card, a transaction cryptogram comprising a message authentication code (MAC), the MAC being generated by encrypting the unique secret identifier with the first unique key and a transaction counter value generated at run time;
• transmitting, by the contactless card, a cryptogram transmission message to the validation HSM, the cryptogram transmission message comprising the transaction cryptogram, the unique secret identifier, the transaction counter value, and the globally unique card identifier;
• verifying, by the validation HSM, the unique secret identifier using the shared-secret master key;
• and
• validating, by the validation HSM, the MAC using the unique secret identifier, the first unique key and the transaction counter value.

A system for secure provision of encryption service for contactless card transactions, comprising

• a computer hardware arrangement;
• and
• a contactless card,
• wherein the computer hardware arrangement is configured to:
• distribute, via secure communication from an encryption service provider, a shared-secret master key to a personalization hardware security module (HSM) associated with a manufacturing entity and a validation HSM associated with a validating entity, wherein the manufacturing HSM and validation HSM are distinct and respectively store a first master key and a second master key,
• generate, by the personalization HSM, a unique secret identifier by encrypting a globally unique card identifier associated with a contactless card, with the shared-secret master key, and
• storing the unique secret identifier in an embossing file on the contactless card during a personalization phase, wherein the embossing file further comprises the globally unique card identifier, a first unique key derived by encrypting the globally unique card identifier with the first master key, and a second unique key derived by encrypting the globally unique card identifier with the second master key;
• wherein the contactless card is configured to:
• generate a transaction cryptogram comprising a message authentication code (MAC), the MAC being generated by encrypting the unique secret identifier with the first unique key and a transaction counter value generated at run time, and
• transmit a cryptogram transmission message to the validation HSM, the cryptogram transmission message comprising the transaction cryptogram, the unique secret identifier, the transaction counter value, and the globally unique card identifier;
• and
• wherein the computer hardware arrangement is further configured to:
• verify, by the validation HSM, the unique secret identifier using the shared- secret master key, and
• validate, by the validation HSM, the MAC using the unique secret identifier, the first unique key and the transaction counter value.