# US 2014/0156989 A1 · Credential Recovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0156989 A1 - Document ID: US20140156989A1 - Status: Published application - Kind: A1 - Application number: 14/096,517 - Filed: 2013-12-04 - Published: 2014-06-05 - Earliest claimed: 2012-12-04 - Assignees: Barclays Bank PLC - Applicants: Barclays Bank PLC - Inventors: Akhil Lalwani; George French - Web page: https://patentgrep.com/patent/US20140156989A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In a credential recovery process, a user is authenticated using an application running on a mobile communications device, and requests recovery of a credential. The application generates a session key encrypted with the public key of a gateway, and sends the encrypted key to the gateway. The gateway recovers the credential from a depository, encrypted using a symmetric key shared with the depository. The gateway decrypts the credential and re-encrypts the credential using the session key. Preferably, the decryption and re-encryption is performed within a hardware secure module within the gateway. The re-encrypted credential is sent to the application, which decrypts the credential and outputs it to the user. In this way, the credential is provided securely to the user and may be made available for use immediately, or nearly so. ## Claims ### Claim 1 A method of credential recovery, comprising the steps of: i. receiving a credential request for a credential using a mobile application on a mobile communication device; ii. securely establishing a session key between the mobile application and a mobile application server; iii. recovering the credential in encrypted form at the mobile application server; iv. decrypting the credential, and re-encrypting the credential to form a re-encrypted credential using the session key, at the mobile application server; v. providing the re-encrypted credential to the mobile application; vi. decrypting the re-encrypted credential at the mobile application to form a decrypted credential; and vii. outputting the decrypted credential from the mobile application. ### Claim 2 (depends on 1) The method of claim 1, wherein the mobile application server decrypts and re-encrypts the credential within a hardware security module. ### Claim 3 (depends on 2) The method of claim 2, including providing to the hardware security module an authentication code based on one or more elements of the credential request, wherein the hardware security module validates the authentication code and provides the re-encrypted credential only if the authentication code is valid. ### Claim 4 (depends on 1) The method of claim 1, wherein securely establishing a session key comprises generating the session key at the mobile application, encrypting the session key using a public key to form an encrypted session key, sending the encrypted session key to the mobile application server, and decrypting the encrypted session key at the mobile application server using a private key corresponding to a public key. ### Claim 5 (depends on 4) The method of claim 4, wherein the step of encrypting the session key includes padding the session key prior to encryption. ### Claim 6 (depends on 1) The method of claim 1, wherein the session key is generated using a nonce generated by the mobile application. ### Claim 7 (depends on 1) The method of claim 1, wherein the session key is generated using a nonce generated by the mobile application server. ### Claim 8 (depends on 1) The method of claim 1, including authenticating a user of the mobile application. ### Claim 9 (depends on 1) The method of claim 1, including deleting the credential from the mobile communication device after outputting the decrypted credential from the mobile application. ### Claim 10 A method of operating a server to provide a credential to a mobile application on a mobile communication device, the method comprising the steps of: i. securely establishing a session key with the mobile application; ii. recovering the credential in encrypted form; iii. decrypting the credential, and re-encrypting the credential using the session key to form a re-encrypted credential; and iv. providing the re-encrypted credential to the mobile application; v. decrypting and outputting, by the mobile application, the credential. ### Claim 11 (depends on 10) The method of claim 10, wherein securely establishing a session key comprises receiving the session key, encrypted using a public key, from the mobile application, and decrypting the session key using a private key corresponding to the public key. ### Claim 12 A method of operating a mobile application to recover a credential on a mobile communication device, comprising the steps of: i. receiving a user request for a credential from a server; ii. securely establishing a session key with the server; iii. receiving the credential, encrypted with the session key, from the server; iv. decrypting the credential using the session key to form a decrypted credential; and v. outputting the decrypted credential.