MX386664B - Método y sistema para mejorar la seguridad de una transacción. - Google Patents

Método y sistema para mejorar la seguridad de una transacción.

Info

Publication number
MX386664B
MX386664B MX2018007696A MX2018007696A MX386664B MX 386664 B MX386664 B MX 386664B MX 2018007696 A MX2018007696 A MX 2018007696A MX 2018007696 A MX2018007696 A MX 2018007696A MX 386664 B MX386664 B MX 386664B
Authority
MX
Mexico
Prior art keywords
transaction
obfuscated
session
cryptographic key
key
Prior art date
Application number
MX2018007696A
Other languages
English (en)
Other versions
MX2018007696A (es
Inventor
Francesco Viola
Original Assignee
Gemalto Sa
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Gemalto Sa filed Critical Gemalto Sa
Publication of MX2018007696A publication Critical patent/MX2018007696A/es
Publication of MX386664B publication Critical patent/MX386664B/es

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/326—Payment applications installed on the mobile devices
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3823—Payment protocols; Details thereof insuring higher security of transaction combining multiple encryption tools for a transaction
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02—Standardisation; Integration
    • H04L41/0246—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
    • H04L41/0273—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols using web services for network management, e.g. simple object access protocol [SOAP]
    • H04L41/0293—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols using web services for network management, e.g. simple object access protocol [SOAP] for accessing web services by means of a binding identification of the management service or element
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/48—Security arrangements using identity modules using secure binding, e.g. securely binding identity modules to devices, services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Business, Economics & Management (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Software Systems (AREA)
  • Finance (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Storage Device Security (AREA)

Abstract

Esta invención se relaciona con un método y un sistema para mejorar la seguridad de transacción en un Circuito Integrado Simulado (ICC). Son proporcionados métodos y dispositivos para pregenerar claves de sesión para asegurar transacciones. La clave de sesión generada es ofuscada con datos de prevención de uso/acceso no autorizado de la criptográfica de sesión y encriptados. Esta clave ofuscada encriptada es proporcionada desde una computadora remota al dispositivo de comunicación. La aplicación móvil es configurada para desencriptar y desofuscar la clave criptográfica de sesión ofuscada encriptada recibida, durante una transacción. El método también puede incluir generar, por medio de dispositivos de comunicación, un criptograma de transacción usando la clave criptográfica de sesión desencriptada y desofuscada y enviando por medio del dispositivo de comunicación al sistema remoto el criptograma de transacción para realizar la transacción. La transacción puede ser autorizada sobre la base de al menos si la clave criptográfica de sesión desencriptada y ofuscada es la esperada. Con la invención, la clave criptográfica de sesión es mantenida nivelada desde el momento en que son proporcionadas hasta el momento muy al final cuando la clave criptográfica de sesión es usada para calcular el criptograma.
MX2018007696A 2015-12-24 2016-12-21 Método y sistema para mejorar la seguridad de una transacción. MX386664B (es)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP15307142.8A EP3185159A1 (en) 2015-12-24 2015-12-24 Method and system for enhancing the security of a transaction
PCT/EP2016/082208 WO2017108970A1 (en) 2015-12-24 2016-12-21 Method and system for enhancing the security of a transaction

Publications (2)

Publication Number Publication Date
MX2018007696A MX2018007696A (es) 2018-08-01
MX386664B true MX386664B (es) 2025-03-19

Family

ID=55083317

Family Applications (1)

Application Number Title Priority Date Filing Date
MX2018007696A MX386664B (es) 2015-12-24 2016-12-21 Método y sistema para mejorar la seguridad de una transacción.

Country Status (6)

Country Link
US (1) US11880832B2 (es)
EP (2) EP3185159A1 (es)
DK (1) DK3394778T3 (es)
ES (1) ES2877522T3 (es)
MX (1) MX386664B (es)
WO (1) WO2017108970A1 (es)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9992027B1 (en) * 2015-09-14 2018-06-05 Amazon Technologies, Inc. Signing key log management
WO2017184840A1 (en) * 2016-04-21 2017-10-26 Mastercard International Incorporated Method and system for contactless transactions without user credentials
CN110770774B (zh) * 2017-06-23 2025-03-21 维萨国际服务协会 数据存储中的验证和加密方案
US10510065B2 (en) * 2018-05-08 2019-12-17 Capital One Services, Llc Interacting with an automated teller machine using a user device
TR201900444A2 (tr) * 2019-01-11 2019-03-21 Kartek Kart Ve Bilisim Teknolojileri Ticaret Anonim Sirketi Güvenlikli ödeme alıcı cihaz için bir yöntem
US11562351B2 (en) * 2019-08-09 2023-01-24 Its, Inc. Interoperable mobile-initiated transactions with dynamic authentication
CN111127014B (zh) * 2019-12-25 2023-09-19 中国银联股份有限公司 交易信息处理方法、服务器、用户终端、系统及存储介质
SG10202003630VA (en) 2020-04-21 2021-09-29 Grabtaxi Holdings Pte Ltd Authentication and validation procedure for improved security in communications systems
DE102020115034A1 (de) * 2020-06-05 2021-12-09 Bundesdruckerei Gmbh Banknote mit Prozessor
US12335241B2 (en) * 2021-11-19 2025-06-17 Safe Harbor Digital Asset Security Llc Cryptographic communication binding system and method
US20250247356A1 (en) * 2024-01-26 2025-07-31 Arm Limited Network Transaction Identifier Uniquification

Family Cites Families (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4529870A (en) * 1980-03-10 1985-07-16 David Chaum Cryptographic identification, financial transaction, and credential device
US4614861A (en) * 1984-11-15 1986-09-30 Intellicard International, Inc. Unitary, self-contained card verification and validation system and method
WO1997004394A1 (en) 1995-07-14 1997-02-06 Christopher Nathan Drake Computer software authentication, protection, and security system
US20020138357A1 (en) * 2001-03-26 2002-09-26 International Business Machines Corporation System and method for purchasing ticket items with user-negotiated security features
US7020645B2 (en) * 2001-04-19 2006-03-28 Eoriginal, Inc. Systems and methods for state-less authentication
US20040117262A1 (en) 2002-12-17 2004-06-17 Berger Jeffrey Keith System and method for conducting a monetary transaction
US7526649B2 (en) * 2003-12-30 2009-04-28 Intel Corporation Session key exchange
US20060137016A1 (en) 2004-12-20 2006-06-22 Dany Margalit Method for blocking unauthorized use of a software application
US20100036777A1 (en) 2008-08-07 2010-02-11 Ebay Inc. Method and system for postal payments and addressing
EP2151795A1 (en) * 2008-08-08 2010-02-10 France Telecom Secure electronic coupon delivery to mobile device
US9501773B2 (en) * 2010-02-02 2016-11-22 Xia Dai Secured transaction system
US20120041879A1 (en) * 2010-08-10 2012-02-16 Paul Kim Methods and systems for payment processing between consumers and merchants
GB201105765D0 (en) * 2011-04-05 2011-05-18 Visa Europe Ltd Payment system
DE102011121567A1 (de) * 2011-12-20 2013-06-20 Giesecke & Devrient Gmbh Verfahren zum kontaktlosen Auslesen eines Identifikationsdokuments
US9246678B2 (en) * 2013-03-14 2016-01-26 Intel Corporation Secure cloud storage and encryption management system
US10460314B2 (en) * 2013-07-10 2019-10-29 Ca, Inc. Pre-generation of session keys for electronic transactions and devices that pre-generate session keys for electronic transactions
RU2663476C2 (ru) 2013-09-20 2018-08-06 Виза Интернэшнл Сервис Ассосиэйшн Защищенная обработка удаленных платежных транзакций, включающая в себя аутентификацию потребителей
US9922322B2 (en) * 2013-12-19 2018-03-20 Visa International Service Association Cloud-based transactions with magnetic secure transmission
BR112016014106A2 (pt) * 2013-12-19 2017-08-08 Visa Int Service Ass Método para intensificar a segurança de um dispositivo de comunicação, e, dispositivo de comunicação
GB2523758A (en) * 2014-03-03 2015-09-09 Mastercard International Inc Secure mobile device transactions
EP3146747B1 (en) * 2014-05-21 2020-07-01 Visa International Service Association Offline authentication
US9801055B2 (en) * 2015-03-30 2017-10-24 Qualcomm Incorporated Authentication and key agreement with perfect forward secrecy

Also Published As

Publication number Publication date
EP3185159A1 (en) 2017-06-28
DK3394778T3 (da) 2021-07-12
EP3394778B1 (en) 2021-04-21
MX2018007696A (es) 2018-08-01
EP3394778A1 (en) 2018-10-31
ES2877522T3 (es) 2021-11-17
WO2017108970A1 (en) 2017-06-29
US11880832B2 (en) 2024-01-23
US20190005493A1 (en) 2019-01-03

Similar Documents

Publication Publication Date Title
MX386664B (es) Método y sistema para mejorar la seguridad de una transacción.
PH12018550176A1 (en) Using hardware based secure isolated region to prevent piracy and cheating on electronic devices
GB2496354B (en) A method and system of providing authentication of user access to a computer resource via a mobile device using multiple separate security factors
AU2018256568A1 (en) Systems and methods for software based encryption
PH12018501745A1 (en) Personal device security using elliptic curve cryptography for secret sharing
GB2528226A (en) Method performed by at least one server for processing a data packet from a first computing device to a second computing device to permit end-to-end
BR112017003018A2 (pt) fornecimento seguro de uma credencial de autenticação
NZ744353A (en) Networked access control system
WO2016144257A3 (en) Method and system for facilitating authentication
GB2498039B (en) Password recovery service
IL261137A (en) System and method for secure communication
GB2512249A (en) Secure peer discovery and authentication using a shared secret
EP2544400A3 (en) PUF based Cryptographic communication system and cryptographic communication method
WO2015121806A3 (en) System and method for securing content keys delivered in manifest files
MX2017001090A (es) Gestion de claves inalambrica para autenticacion.
WO2017034642A3 (en) Optimizable full-path encryption in a virtualization environment
PE20170656A1 (es) Autenticacion de la red de servicio
TW201612787A (en) Network authentication method for secure electronic transactions
SG10201803986RA (en) Method and system for secure transmission of remote notification service messages to mobile devices without secure elements
WO2015157735A3 (en) Content encryption and decryption
JP2016504693A5 (es)
IN2014KN02750A (es)
WO2016130406A3 (en) Protecting sensitive data security
WO2013167043A3 (zh) 数据安全验证方法和装置
WO2010011921A3 (en) Http authentication and authorization management