CA2981665C - Systeme et procede pour generation et echange de cle de session - Google Patents

Systeme et procede pour generation et echange de cle de session Download PDF

Info

Publication number
CA2981665C
CA2981665C CA2981665A CA2981665A CA2981665C CA 2981665 C CA2981665 C CA 2981665C CA 2981665 A CA2981665 A CA 2981665A CA 2981665 A CA2981665 A CA 2981665A CA 2981665 C CA2981665 C CA 2981665C
Authority
CA
Canada
Prior art keywords
electronic device
payment
secret value
fingerprint
session key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CA2981665A
Other languages
English (en)
Other versions
CA2981665A1 (fr
Inventor
Milos Dunjic
Perry Aaron Jones Haldenby
Arthur Carroll Chow
Anthony Haituyen Nguyen
Het Anand Patel
Casey Lyn Doyle
Yubing LIU
John Jong Suk Lee
David Samuel Tax
Arun Victor JAGGA
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Toronto Dominion Bank
Original Assignee
Toronto Dominion Bank
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Toronto Dominion Bank filed Critical Toronto Dominion Bank
Priority to CA2981665A priority Critical patent/CA2981665C/fr
Priority to CA3230364A priority patent/CA3230364A1/fr
Publication of CA2981665A1 publication Critical patent/CA2981665A1/fr
Application granted granted Critical
Publication of CA2981665C publication Critical patent/CA2981665C/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/20—Point-of-sale [POS] network systems
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Accounting & Taxation (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Finance (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

Il est décrit des systèmes et procédés mis en uvre par ordinateur dépendant de létablissement dune clé de session commune entre un dispositif électronique et un serveur informatique. Les systèmes et procédés peuvent être conçus pour le traitement de demandes de mise hors jeton dans le traitement de transactions par paiement et pour la préparation dun dispositif électronique afin deffectuer des transactions par paiement. Lors dune telle transaction, le serveur peut effectuer un procédé qui comprend la réception dune demande de mise hors jeton, y compris un jeton de paiement et un cryptogramme généré par le dispositif électronique à laide dune clé de session générée par le dispositif électronique d'après une empreinte digitale du dispositif électronique, une valeur secrète communiquée précédemment au dispositif électronique, le jeton de paiement, et un compteur de transaction; la récupération de lempreinte digitale, de la valeur secrète et du compteur de transaction, et la génération de la clé de session d'après ce qui précède; la vérification du cryptogramme à laide de la clé de session; la récupération dun numéro de compte connexe; et lenvoi dune réponse à la demande, y compris le numéro de compte.
CA2981665A 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session Active CA2981665C (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CA2981665A CA2981665C (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session
CA3230364A CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CA2981665A CA2981665C (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Related Child Applications (1)

Application Number Title Priority Date Filing Date
CA3230364A Division CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Publications (2)

Publication Number Publication Date
CA2981665A1 CA2981665A1 (fr) 2019-04-05
CA2981665C true CA2981665C (fr) 2024-04-09

Family

ID=65992252

Family Applications (2)

Application Number Title Priority Date Filing Date
CA3230364A Pending CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session
CA2981665A Active CA2981665C (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Family Applications Before (1)

Application Number Title Priority Date Filing Date
CA3230364A Pending CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Country Status (1)

Country Link
CA (2) CA3230364A1 (fr)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10915897B2 (en) * 2018-06-13 2021-02-09 Clover Network, Inc. Token management for enhanced omni-channel payments experience and analytics

Also Published As

Publication number Publication date
CA3230364A1 (fr) 2019-04-05
CA2981665A1 (fr) 2019-04-05

Similar Documents

Publication Publication Date Title
US11769148B2 (en) System and method of session key generation and exchange
US11068608B2 (en) Mutual authentication of software layers
US12051064B2 (en) Transaction messaging
EP2945410B1 (fr) Sécurité pour des applications mobiles
EP3050247B1 (fr) Procédé de sécurisation de communication hertzienne entre une application mobile et une passerelle
EP3022700B1 (fr) Traitement de transaction de paiement à distance sécurisé
US11496456B2 (en) Systems and methods encrypting messages using multiple certificates
US11636478B2 (en) Method of performing authentication for a transaction and a system thereof
US20170032362A1 (en) Streamlined enrollment of credit cards in mobile wallets
US20150128243A1 (en) Method of authenticating a device and encrypting data transmitted between the device and a server
US20220284431A1 (en) System and Method for a Self-Calculating Token Vault
CA2981665C (fr) Systeme et procede pour generation et echange de cle de session
US20240020694A1 (en) Rapid secure wireless transaction
US20180212784A1 (en) Method to secure an applicative function in a cloud-based virtual secure element implementation
EP4307611A1 (fr) Communication de données et opérations cryptographiques pour des interactions sans fil sécurisées
HK1219193B (en) Security for mobile applications

Legal Events

Date Code Title Description
EEER Examination request

Effective date: 20210226

MPN Maintenance fee for patent paid

Free format text: FEE DESCRIPTION TEXT: MF (PATENT, 7TH ANNIV.) - STANDARD

Year of fee payment: 7

U00 Fee paid

Free format text: ST27 STATUS EVENT CODE: A-4-4-U10-U00-U101 (AS PROVIDED BY THE NATIONAL OFFICE); EVENT TEXT: MAINTENANCE REQUEST RECEIVED

Effective date: 20240829

U11 Full renewal or maintenance fee paid

Free format text: ST27 STATUS EVENT CODE: A-4-4-U10-U11-U102 (AS PROVIDED BY THE NATIONAL OFFICE); EVENT TEXT: MAINTENANCE FEE PAYMENT DETERMINED COMPLIANT

Effective date: 20240829

Free format text: ST27 STATUS EVENT CODE: A-4-4-U10-U11-U102 (AS PROVIDED BY THE NATIONAL OFFICE); EVENT TEXT: MAINTENANCE FEE PAYMENT PAID IN FULL

Effective date: 20240829

MPN Maintenance fee for patent paid

Free format text: FEE DESCRIPTION TEXT: MF (PATENT, 8TH ANNIV.) - STANDARD

Year of fee payment: 8

U00 Fee paid

Free format text: ST27 STATUS EVENT CODE: A-4-4-U10-U00-U101 (AS PROVIDED BY THE NATIONAL OFFICE); EVENT TEXT: MAINTENANCE REQUEST RECEIVED

Effective date: 20250903

U11 Full renewal or maintenance fee paid

Free format text: ST27 STATUS EVENT CODE: A-4-4-U10-U11-U102 (AS PROVIDED BY THE NATIONAL OFFICE); EVENT TEXT: MAINTENANCE FEE PAYMENT PAID IN FULL

Effective date: 20250903