Back to results
US 2022/0070001 A1Published application
Methods for secure credential provisioning
AssigneeVisa International Service Association
InventorsEric Le Saint, Soumendra Bhattacharya
Life of this patent
Estimating the term…
Abstract
Embodiments can provide methods for securely provisioning sensitive credential data, such as a limited use key (LUK) onto a user device. In some embodiments, the credential data can be encrypted using a separate storage protection key and decrypted only at the time of a transaction to generate a cryptogram for the transaction. Thus, end-to-end protection can be provided during the transit and storage of the credential data, limiting the exposure of the credential data only when the credential data is required, thereby reducing the risk of compromise of the credential data.
Claims20
A computer-implemented method, comprising:
- receiving, by a server computer from a user device, a provisioning request message including a one-time user public key;
- generating, by the server computer, a response shared secret using a static server private key and the one-time user public key;
- identifying, by the server computer, credential data to be included in a provisioning response message;
- determining, by the server computer, a response session key from the response shared secret, the response session key usable for encrypting the provisioning response message;
- determining, by the server computer, a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for encrypting the credential data;
- encrypting, by the server computer, the credential data using the storage protection key to generate encrypted credential data;
- encrypting, by the server computer, the provisioning response message using the response session key to generate encrypted provisioning response message, wherein the provisioning response message includes the encrypted credential data;
- and
- sending, by the server computer to the user device, the encrypted provisioning response message.
6 more elements
A computer-implemented method, comprising:
- receiving by a server computer from a user device, a provisioning request message including a one-time user public key and a storage protection public key;
- generating, by the server computer, a response shared secret using a static server private key and the one-time user public key;
- identifying, by the server computer, credential data to be included in a provisioning response message;
- determining, by the server computer, a response session key from the response shared secret, the response session key usable for encrypting the provisioning response message;
- encrypting, by the server computer, the credential data using the storage protection public key to generate encrypted credential data;
- encrypting, by the server computer, the provisioning response message using the response session key to generate encrypted provisioning response message, wherein the provisioning response message includes the encrypted credential data;
- and
- sending, by the server computer to the user device, the encrypted provisioning response message.
5 more elements
A server computer, comprising:
- a memory that stores computer-executable instructions;
- and
- a processor configured to access the memory and execute the computer-executable instructions to implement a method comprising:
- receiving, from a user device, a provisioning request message including a one-time user public key;
- generating a response shared secret using a static server private key and the one-time user public key;
- identifying credential data to be included in a provisioning response message;
- determining a response session key from the response shared secret, the response session key usable for encrypting the provisioning response message;
- determining a storage protection key from the response shared secret, the storage protection key being different from the response session key and usable for encrypting the credential data;
- encrypting the credential data using the storage protection key to generate encrypted credential data;
- encrypting the provisioning response message using the response session key to generate encrypted provisioning response message, wherein the provisioning response message includes the encrypted credential data;
- and
- sending, to the user device, the encrypted provisioning response message.
9 more elements
Dependencies are inferred from the claim text.