CA2981665A1 - Systeme et procede pour generation et echange de cle de session - Google Patents

Systeme et procede pour generation et echange de cle de session Download PDF

Info

Publication number
CA2981665A1
CA2981665A1 CA2981665A CA2981665A CA2981665A1 CA 2981665 A1 CA2981665 A1 CA 2981665A1 CA 2981665 A CA2981665 A CA 2981665A CA 2981665 A CA2981665 A CA 2981665A CA 2981665 A1 CA2981665 A1 CA 2981665A1
Authority
CA
Canada
Prior art keywords
electronic device
payment
session key
cryptogram
fingerprint
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CA2981665A
Other languages
English (en)
Other versions
CA2981665C (fr
Inventor
Milos Dunjic
Perry Aaron Jones Haldenby
Arthur Carroll Chow
Anthony Haituyen Nguyen
Het Anand Patel
Casey Lyn Doyle
Yubing LIU
John Jong Suk Lee
David Samuel Tax
Arun Victor JAGGA
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Toronto Dominion Bank
Original Assignee
Toronto Dominion Bank
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Toronto Dominion Bank filed Critical Toronto Dominion Bank
Priority to CA3230364A priority Critical patent/CA3230364A1/fr
Priority to CA2981665A priority patent/CA2981665C/fr
Publication of CA2981665A1 publication Critical patent/CA2981665A1/fr
Application granted granted Critical
Publication of CA2981665C publication Critical patent/CA2981665C/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/20—Point-of-sale [POS] network systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Abstract

Il est décrit des systèmes et procédés mis en uvre par ordinateur dépendant de létablissement dune clé de session commune entre un dispositif électronique et un serveur informatique. Les systèmes et procédés peuvent être conçus pour le traitement de demandes de mise hors jeton dans le traitement de transactions par paiement et pour la préparation dun dispositif électronique afin deffectuer des transactions par paiement. Lors dune telle transaction, le serveur peut effectuer un procédé qui comprend la réception dune demande de mise hors jeton, y compris un jeton de paiement et un cryptogramme généré par le dispositif électronique à laide dune clé de session générée par le dispositif électronique d'après une empreinte digitale du dispositif électronique, une valeur secrète communiquée précédemment au dispositif électronique, le jeton de paiement, et un compteur de transaction; la récupération de lempreinte digitale, de la valeur secrète et du compteur de transaction, et la génération de la clé de session d'après ce qui précède; la vérification du cryptogramme à laide de la clé de session; la récupération dun numéro de compte connexe; et lenvoi dune réponse à la demande, y compris le numéro de compte.
CA2981665A 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session Active CA2981665C (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CA3230364A CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session
CA2981665A CA2981665C (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CA2981665A CA2981665C (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Related Child Applications (1)

Application Number Title Priority Date Filing Date
CA3230364A Division CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Publications (2)

Publication Number Publication Date
CA2981665A1 true CA2981665A1 (fr) 2019-04-05
CA2981665C CA2981665C (fr) 2024-04-09

Family

ID=65992252

Family Applications (2)

Application Number Title Priority Date Filing Date
CA3230364A Pending CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session
CA2981665A Active CA2981665C (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Family Applications Before (1)

Application Number Title Priority Date Filing Date
CA3230364A Pending CA3230364A1 (fr) 2017-10-05 2017-10-05 Systeme et procede pour generation et echange de cle de session

Country Status (1)

Country Link
CA (2) CA3230364A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10915897B2 (en) * 2018-06-13 2021-02-09 Clover Network, Inc. Token management for enhanced omni-channel payments experience and analytics

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10915897B2 (en) * 2018-06-13 2021-02-09 Clover Network, Inc. Token management for enhanced omni-channel payments experience and analytics

Also Published As

Publication number Publication date
CA3230364A1 (fr) 2019-04-05
CA2981665C (fr) 2024-04-09

Similar Documents

Publication Publication Date Title
US11769148B2 (en) System and method of session key generation and exchange
US11068608B2 (en) Mutual authentication of software layers
US20210344495A1 (en) Contactless card emulation system and method
US20200372503A1 (en) Transaction messaging
EP2945410B1 (fr) Sécurité pour des applications mobiles
CN107925572B (zh) 软件应用程序到通信装置的安全绑定
EP3251284B1 (fr) Procédés de fourniture de justificatifs d'identité sécurisé
EP3050247B1 (fr) Procédé de sécurisation de communication hertzienne entre une application mobile et une passerelle
US11496456B2 (en) Systems and methods encrypting messages using multiple certificates
JP2018185852A (ja) セキュアな遠隔決済取引処理
US20170032362A1 (en) Streamlined enrollment of credit cards in mobile wallets
US11636478B2 (en) Method of performing authentication for a transaction and a system thereof
US20150128243A1 (en) Method of authenticating a device and encrypting data transmitted between the device and a server
CA2981665C (fr) Systeme et procede pour generation et echange de cle de session
US20230090972A1 (en) Online secret encryption
US20180212784A1 (en) Method to secure an applicative function in a cloud-based virtual secure element implementation
EP4307610A1 (fr) Transaction sans fil rapide sécurisée
EP4307611A1 (fr) Communication de données et opérations cryptographiques pour des interactions sans fil sécurisées
Harnaningrum et al. Mobile Payment Transaction Model with Robust Security in the NFC-HCE Ecosystem with Secure Elements on Smartphones

Legal Events

Date Code Title Description
EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226

EEER Examination request

Effective date: 20210226