System and method for authenticating access tokens

Abstract

The authentication system and method may include a first device having a memory, a communication interface, and one or more processors. The memory includes a counter value, transmission data, and at least one key. The one or more processors are in communication with the memory and the one or more processors. The one or more processors may generate a ciphertext including the counter value and the transmission data using the at least one key and the counter value, transmit the ciphertext via the communication interface, update the counter value after transmitting the ciphertext, receive an encrypted access token via the communication interface, decrypt the encrypted access token, store the decrypted access token in a memory, and transmit the encrypted access token via the communication interface for accessing one or more resources after the communication interface enters a communication field.

Description

[Technical field]

[0001] This application claims priority to U.S. Patent Application No. 17 / 161,488, filed January 28, 2021, the entire disclosure of which is incorporated herein by reference.

[0002] The present disclosure relates to a system and method for authenticating access tokens. [Background technology]

[0003] Card-based transactions are becoming increasingly common. These transactions often require the use of a card that communicates with a point-of-sale device, server, or other device. Such communications must be protected from interception and unauthorized access. However, data transmission in the clear, i.e. without encryption or other protection, is susceptible to phishing and replay attacks, resulting in increased security risks and misuse of accounts and cards. These risks may be increased by the use of contactless cards, which communicate wirelessly with other devices.

[0004] These and other deficiencies exist. Therefore, what is needed is a system and method for authenticating access tokens that overcomes these deficiencies and provides access to one or more resources in a secure and reliable manner by protecting communications from eavesdropping and unauthorized access. Summary of the Invention

[0005] An embodiment of the present disclosure provides a first device including: The first device may include a memory including a counter value, transmission data, and at least one key. The first device may include a communication interface. The first device may include one or more processors in communication with the memory and the communication interface. The one or more processors may generate a ciphertext including the counter value and the transmission data using the at least one key and the counter value. The one or more processors may transmit the ciphertext via the communication interface. The one or more processors may update the counter value after transmitting the ciphertext. The one or more processors may receive an encrypted access token via the communication interface. The one or more processors may decrypt the encrypted access token. The one or more processors may store the decrypted access token in a memory. The one or more processors may transmit the encrypted access token via the communication interface to access one or more resources after the communication interface enters a communication field.

[0006] An embodiment of the present disclosure provides an authentication method. The method may generate a ciphertext including the counter value and transmitted data using at least one key and a counter value. The method may transmit the ciphertext via the communication interface. The method may update the counter value. The method may receive an encrypted access token via the communication interface. The method may decrypt the encrypted access token. The method may store the decrypted access token in a memory. The method may transmit the encrypted access token via the communication interface to receive access to one or more resources after the communication interface enters a communication field.

[0007] An embodiment of the present disclosure provides a non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor and the computer to perform operations including generating a counter value and a transmitted data ciphertext using one or more keys and a counter value, transmitting the ciphertext, updating the counter value, receiving an encrypted access token, decrypting the encrypted access token, transmitting the encrypted access token over the communication interface after the communication interface enters a communication field, and receiving access to one or more resources after authenticating the access token.

[0008] Various embodiments of the present disclosure, together with further objects and advantages, may be better understood by reference to the following description taken in conjunction with the accompanying drawings, in which: [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example of an authentication system according to an embodiment. [Figure 2A] FIG. 2A illustrates an example of a contactless card according to an embodiment. [Figure 2B] FIG. 2B illustrates an example of a contact pad of a contactless card according to an embodiment. [Diagram 3] FIG. 3 illustrates an example of an authentication method according to an embodiment. [Figure 4] FIG. 4 illustrates an example of a sequence diagram of an authentication process according to the embodiment. [Diagram 5] FIG. 5 illustrates an example of an authentication system according to an embodiment. [Figure 6] FIG. 6 illustrates an example of an authentication method according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The following description of the embodiments provides non-limiting representative examples with reference to reference numbers to particularly explain the features and teachings of various aspects of the present invention. It will be recognized from the description of the embodiments that the described embodiments can be implemented separately or in combination with other embodiments. Those skilled in the art who review the description of the embodiments will be able to learn and understand the various aspects of the present invention described. The description of the embodiments should facilitate the understanding of the present invention to the extent that other implementations that are not specifically covered but are within the knowledge of those skilled in the art who read the description of the embodiments will be understood to be consistent with the application of the present invention.

[0011] Advantages of the systems and methods disclosed herein include improved security for providing access to one or more resources by protecting communications from interception and unauthorized access. The systems and methods disclosed herein allow for the avoidance of phishing attacks and the prevention of replay attacks through encrypted data communications and the elimination of the need to transmit data in clear text. Furthermore, by generating and authenticating access tokens and challenge responses, access tokens and cards can be securely issued, verified, and reissued, rather than collecting cards and programming each card for reissue, reducing security risks, improving user experience, and increasing transaction efficiency. Thus, the systems and methods disclosed herein reduce the risk of fraudulent activities, such as misuse of cards or accounts associated with the cards.

[0012] Figure 1 illustrates an authentication system 100. System 100 may include a first device 105, a second device 112, a third device 117, a network 120, a server 125, and a database 130. Figure 1 illustrates an example of elements of system 100, although system 100 may include any number of elements.

[0013] The system 100 may include a first device 105. The first device 105 may include a contactless card, a contact card, or other devices described herein. As further described below with reference to Figures 2A-2B, the first device 105 may include one or more processors 102 and a memory 104. The memory 104 may include one or more applets 106 and one or more counters 108. Each counter 108 may include a counter value. The memory 104 may include a counter value, transmission data, and at least one key.

[0014] The first device 105 may include a communication interface 107. The communication interface 107 may include communication capabilities with a physical interface and a contactless interface. For example, the communication interface 107 may communicate with the physical interface by swiping through a card swipe interface or by inserting into a card chip reader on an automated teller machine (ATM) or other device that communicates through the physical interface. In other examples, the communication interface 107 may establish contactless communication with a card reader through near-field wireless communication methods such as NFC, Bluetooth, Wi-Fi, RFID, and other forms of contactless communication. As shown in FIG. 1, the communication interface 107 may directly communicate with the second device 112, the third device 117, the server 125, and / or the database 130 through the network 120.

[0015] The first device 105 can be in data communication with any number of elements of the system 100. For example, the first device 105 can transmit data to the second device 112, the third device 117, and / or the server 125 over the network 120. The first device 105 can transmit data to the database 130 over the network 120. In some examples, the first device 105 can transmit data over the network 120 after entering one or more communication fields of any device. Without limitation, each entry can be associated with a tap, a swipe, a wave, and / or any combination thereof.

[0016] The system 100 may include a second device 112. The second device 112 may include one or more processors 113, and a memory 114. The memory 114 may include one or more applications, including but not limited to a first application 110 and a second application 111. The second device 112 may be in data communication with any number of elements of the system 100. For example, the second device 112 may transmit data to a server 125 via a network 120. The second device 112 may transmit data to a database 130 via a network 120. Without limitation, the device 112 may be a network-enabled computer. As referred to herein, a network-enabled computer includes any computing or communication device, including but not limited to a server, network appliance, personal computer, workstation, telephone, handheld PC, personal digital assistant, contactless card, thin client, fat client, Internet browser, kiosk, tablet, terminal, or other device. The second device 112 may be a mobile device. For example, mobile devices include Apple's iPhone, iPod, iPad, or other mobile devices running Apple's iOS operating system, any device running Microsoft's Windows mobile operating system, any device running Google's Android operating system, or other smartphones, tablets, or similar wearable mobile devices.

[0017] The second device 112 may include processing circuitry and may include additional elements including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware as necessary to perform the functions described herein. The second device 112 may further include a display and input devices. The display may be any type of device that presents visual information, such as a computer monitor, a flat panel display, a mobile device screen including a liquid crystal display, a light emitting diode display, a plasma panel, a cathode ray tube display. The input devices may include any device available and supported by the user's device for inputting information into the user's device, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder or camcorder. These devices may be used to input information and interact with the software and other devices described herein.

[0018] The system 100 may include a third device 117. The third device 117 may include one or more processors 116 and a memory 118. The memory 118 may include one or more applications, such as the application 115. The third device 117 may be in data communication with any number of elements of the system 100. For example, the third device 117 may transmit data to a server 125 over a network 120. The third device 117 may transmit data to a database 130 over a network 120. Without limitation, the third device 117 may be a network-enabled computer. As referred to herein, a network-enabled computer includes computing or communication devices including, but not limited to, a server, a network appliance, a personal computer, a workstation, a telephone, a handheld PC, a personal digital assistant, a contactless card, a thin client, a fat client, an Internet browser, a kiosk, a tablet, a terminal, a reader, or other device. The third device 117 may be a mobile device. For example, a mobile device may include an Apple iPhone®, iPod®, iPad®, or other mobile device that runs Apple's iOS® operating system, any device that runs Microsoft's Windows mobile operating system, any device that runs Google's Android operating system, or other smartphones, tablets, or similar wearable mobile devices.

[0019] The third device 117 may include processing circuitry and may include additional elements including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware as necessary to perform the functions described herein. The third device 117 may further include a display and input devices. The display may be any type of device that presents visual information, such as a computer monitor, a flat panel display, a liquid crystal display, a light emitting diode display, a mobile device screen including a plasma panel, a cathode ray tube display. The input devices may include any device available and supported by the user's device for inputting information into the user's device, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder or camcorder. These devices may be used to input information and interact with the software and other devices described herein.

[0020] The system 100 may include a network 120. In some examples, the network 120 may be one or more of a wireless network, a wired network, or any combination of wireless and wired networks and may connect to any one of the elements of the system 100. For example, the first device 105 may be connected to a server 125 via the network 120. In some examples, the network 120 may include one or more of a fiber optic network, a passive optical network, a cable network, an Internet network, a satellite network, a wireless local area network (LAN), a global system for mobile communications, a personal communication service, a personal area network, a wireless application protocol, a multimedia messaging service, an enhanced messaging service, a short message service, a time division multiplexing based system, a code division multiple access based system, a D-AMPS, Wi-Fi, fixed wireless data, IEEE 802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth, NFC, radio frequency identification (RFID), Wi-Fi, and the like.

[0021] Additionally, network 120 may include a global network, such as, but not limited to, telephone lines, optical fiber, IEEE Ethernet 902.3, wide area networks, wireless personal area networks, LANs, or the Internet. Additionally, network 120 may support an Internet network, a wireless communication network, a cellular network, or the like, or any combination thereof. Network 120 may further include one network, or any number of the exemplary types of networks described above, and may operate as a standalone network or in conjunction with one another. Network 120 may utilize one or more protocols of one or more network elements to which they are communicatively coupled. Network 120 may translate from other protocols to one or more protocols of the network devices. Although network 120 is shown as a single network, according to one or more examples, it will be understood that network 120 may include multiple interconnected networks, such as, for example, the Internet, a service provider's network, a cable television network, an enterprise network such as a credit card association network, and a home network.

[0022] The system 100 may include one or more servers 125. In some examples, the server 125 may include one or more processors 127 coupled to a memory 129. The server 125 may be configured as a central system, server, or platform that controls and calls various data to perform multiple workflow actions at different times. The server 125 may be connected to the first device 105. The server 125 may be in data communication with the applet 106, the application 110, the application 111, and / or the application 115. For example, the server 125 may be in data communication with the applet 106. The first device 105 may communicate with the one or more servers 125 via one or more networks 120 and may operate as a respective front-end to back-end pair with the server 125. The first device 105 may send one or more requests to the server 125, for example, from the applet 106 executing thereon. The one or more requests may be associated with retrieving data from the server 125. The server 125 can receive one or more requests from the first device 105. Based on the one or more requests from the applet 106, the server 125 may obtain the requested data. The server 125 may transmit the received data to the applet 106, and the received data may be in response to the one or more requests.

[0023] In some examples, server 125 may be a dedicated server computer, such as a blade server, or may be a personal computer, laptop computer, notebook computer, palmtop computer, network computer, mobile device, wearable device, or any processor-controlled device capable of supporting system 100. While FIGURE 1 illustrates a single server 125, it will be understood that in other embodiments, multiple servers or multiple computer systems may be used as needed or desired to support users, and backup or redundant servers may also be used to prevent network downtime in the event that a particular server fails.

[0024] The server 125 may include applications that include instructions to execute on the server 125. For example, the applications may include instructions to execute on the server 125. The applications may communicate with any element of the system 100. For example, the server 125 may execute one or more applications that enable network and / or data communication with, for example, one or more elements of the system 100 to transmit and / or receive data. Without limitation, the server 125 may be a network-enabled computer. As referred to herein, a network-enabled computer includes computing or communication devices including, but not limited to, a server, network appliance, personal computer, workstation, telephone, handheld PC, personal digital assistant, contactless card, thin client, fat client, Internet browser, or other device. The server 125 may be a mobile device. For example, the mobile device may include an Apple iPhone, iPod, iPad, or other mobile device running Apple's iOS operating system, any device running Microsoft's Windows mobile operating system, any device running Google's Android operating system, or other smartphone, tablet, or similar wearable mobile device.

[0025] Server 125 may include processing circuitry and may include additional elements including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware, as necessary, to perform the functions described herein. Server 125 may further include displays and input devices. Displays may be any type of device that presents visual information, such as computer monitors, flat panel displays, liquid crystal displays, light emitting diode displays, plasma panels, mobile device screens including cathode ray tube displays. Input devices may include any device available and supported by the user's device for inputting information into the user's device, such as a touch screen, keyboard, mouse, cursor control device, touch screen, microphone, digital camera, video recorder or camcorder. These devices may be used to input information and interact with the software and other devices described herein.

[0026] The system 100 may include one or more databases 130. The database 130 may include a relational database, a non-relational database, or other database implementations, including multiple relational and non-relational databases, and any combination thereof. In some examples, the database 130 may include a desktop database, a mobile database, or an in-memory database. Furthermore, the database 130 may be hosted internally by any element of the system 100, such as the first device 105 or the server 125. Or, the database 130 may be hosted externally to any element of the system 100, such as the first device 105 or the server, by a cloud-based platform, or in any storage device in data communication with the first device 105 and the server 125. In some examples, the database 130 may be in data communication with any number of elements of the system 100. For example, the server 125 may retrieve requested data sent by the applet 106 from the database 130. The server 125 may transmit received data from the database 130 over the network 120 to the applet 106, the received data responding to one or more requests in response to the transmitted data. In other examples, the applet 106 may transmit one or more requests for the requested data from the database 130 over the network 120.

[0027] In some examples, the exemplary procedures according to the present disclosure described herein may be executed by a processing device and / or computing device (e.g., computer hardware device). Such a processing / computing device may be all, part, or include a computer / processor, including, but not limited to, one or more microprocessors, and may utilize instructions stored on a computer-accessible medium (e.g., RAM, ROM, hard drive, or other storage device). For example, the computer-accessible medium may be part of the memory of the first device 105, the server 125, and / or the database 130, or other computer hardware device.

[0028] In some examples, a computer-accessible medium (e.g., a storage device such as a hard disk, floppy disk, memory stick, CD-ROM, RAM, ROM, or combination thereof, as described above herein) may be provided (e.g., in communication with a processing device). The computer-accessible medium may include executable instructions. Additionally or alternatively, a storage device may be provided separately from the computer-accessible medium, and the storage device may provide instructions to the processing device to perform certain example procedures, processes, and methods, e.g., as described above herein.

[0029] The one or more processors 102 may generate a cryptogram using at least one of the key and the counter value. The cryptogram may include the counter value and the transmission data. The one or more processors 102 may transmit the cryptogram via the communication interface 107. For example, the one or more processors 102 may transmit the cryptogram to one or more applications. In some examples, the one or more processors 102 may transmit the cryptogram to the first application 110, the cryptogram including instructions to execute on the second device 112. The one or more processors 102 may update the counter value after transmitting the cryptogram. The one or more processors 102 may receive an access token via the communication interface 107. For example, the one or more processors 102 may receive an access token from the first application 110. In some examples, the access token is generated and / or encrypted in the first application 110. In some examples, the access token may be generated when a user authenticates to a first or primary system. The first or primary system may include an application or a network login. The application includes, but is not limited to, a first application 110 that includes instructions executed on the second device 112. The network login includes, but is not limited to, a login associated with the network 120. At that point, an access token may be generated that encapsulates a security identity established through presentation of one or more credentials including, but not limited to, at least one selected from the group of username and / or password, mobile device number, account number, card number, and biometric authentication (face scan, retina scan, fingerprint, fingerprint, voice for voice recognition, etc.). A database that is initially authenticated, such as database 130, may generate the token. In this model, the access token is encrypted and sent to the first device 105 for secure storage. When the user wishes to access the second system, the first device 105 may be presented and the second system may query it.As long as the access token is still valid and the first and second systems are mutually respectful, the user can access the secondary system through protocols such as OAuth or Security Assertion Markup Language (SAML). In some examples, the access token may be encrypted before transmission. For example, the first application 110 may encrypt the access token before transmitting it to the one or more processors 102 of the first device 105.

[0030] The one or more processors 102 may decode the access token. The one or more processors 102 may store the access token in the memory 104. The one or more processors 102 may transmit the access token after one or more entries of the communication interface 107 enter into the communication field of any device. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. For example, the one or more processors 102 may transmit the access token to the first application 110. The access token may be transmitted via Near Field Communication (NFC). Without being limited thereto, the access token may be transmitted via Bluetooth, Wi-Fi, RFID.

[0031] In another example, the one or more processors 102 may transmit the access token to the second application 111 that includes instructions to execute on the second device 112. The one or more processors 102 may transmit the access token after one or more entries of the communication interface 107 enter into the communication field of the second device 112. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. For example, the one or more processors 102 may transmit the access token to the second application 111. The access token may be transmitted via Near Field Communication (NFC). Without limitation, the access token may be transmitted via Bluetooth, Wi-Fi, RFID.

[0032] In another example, the one or more processors 102 may transmit the access token to an application 115 that includes instructions to execute on the third device 117. The one or more processors 102 may transmit the access token after one or more entries of the communication interface 107 enter a communication field of the third device 117. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. The access token may be transmitted via Near Field Communication (NFC). Without limitation, the access token may be transmitted via Bluetooth, Wi-Fi, RFID.

[0033] The access token may be sent for validation before providing access to one or more resources. For example, an application 115 including instructions executing on a third device 117 may receive an access token from the one or more processors 102 and validate the access token by sending one or more requests to one or more servers 125. The one or more servers 125 may receive one or more requests from the application 115 including instructions executing on the third device 117. The one or more requests may include the access token. The one or more servers 125 may validate the access token by comparison with a reference access token and determine if a match is successful. In some examples, the server 125 may validate the access token. If the comparison of the access token to the reference access token results in a match, the access token is validated and access to the one or more resources is provided. If the comparison of the access token to the reference access token does not result in a match, access to the one or more resources may proceed further in the following manner. For example, based on the determination of an unsuccessful match, access to the one or more resources may be denied. In other examples, access to the one or more resources may be retried up to a number of times including a predetermined threshold number of times by resending and rereceiving the access token before denying access to the one or more resources. In this manner, access to one or more resources may be denied and / or authorization privileges may be revoked after the token has been used, as described further below.

[0034] In some examples, the database 130 may validate the access token. For example, one or more servers 125 may send one or more requests to the database 130 to validate the access token. The one or more requests may include the access token. The database 130 may receive one or more requests from one or more servers 125. The database 130 may validate the access token by comparison with a reference access token to determine if a match is successful. If the comparison of the access token to the reference access token results in a match, the access token is validated and access to the one or more resources is provided. If the comparison of the access token to the reference access token does not result in a match, access to the one or more resources may proceed further in the following manner. In some examples, based on the determination of an unsuccessful match, access to the one or more resources may be denied. In other examples, the request for access to the one or more resources may be retried up to a predetermined threshold number of times by resending and rereceiving the access token before denying access to the one or more resources. In this manner, access to one or more resources may be denied and / or authorization privileges may be revoked after use of the token, as described further below.

[0035] The access token may include a limited-use token. The access token may include one or more elements, such as an access identifier. The access identifier may identify a user across multiple systems, such as a first system and a second system. The access identifier may be unique to the user, associated with a login session, and / or a combination thereof. In some examples, the access identifier may include a group of identifiers that may indicate the user as belonging to one or more access groups. In some examples, the token may include a single-use token. In other examples, the token may include a time-based token. For example, the token may be limited to use for a predetermined period of time, such as at least one selected from the group of seconds, minutes, hours, days, weeks, months, years, and / or any combination thereof. After the token is used, such as after a single use and / or after the predetermined period of use has expired, the token may be disabled and no longer usable.

[0036] In some examples, the first application 110 including instructions to execute on the second device 112 may be a different application than the second application 111 including instructions to execute on the second device 112. In some examples, the second device may be different from the third device 117. In some examples, the third device 117 may be external to the second device 112. For example, the third device 117 may not be part of the second device 112. In some examples, the third device 117 may be integral with the second device 112. For example, the third device 117 may be part of or internal to the second device 112. The third device 117 may include a reader, such as a card reader. In some examples, the card reader may provide access to a physical space. In some examples, the card reader may provide access to a digital experience. In some examples, the card reader may provide access to a ticketed event. In some examples, the card reader may provide access to a safe deposit box. In some examples, the card reader may provide access to another device, such as a network-enabled computer.

[0037] In another example, the one or more processors 102 may receive one or more challenges from the first application 110 via the communication interface 107, the challenges including instructions to execute on the second device 112. The challenges may include a public key and an encrypted test. The one or more processors 102 may transmit one or more responses to the one or more challenges via the communication interface 107. For example, the one or more processors 102 may transmit a challenge response to the first application 110 via the communication interface 107, the challenge response including instructions to execute on the second device 112.

[0038] In another example, the one or more processors 102 may receive one or more challenges via the communication interface 107. For example, the one or more processors 102 may receive a challenge from an application 115 including instructions executing on the third device 117. The challenge may include a public key and an encrypted test. The one or more processors 102 may transmit one or more responses in response to the one or more challenges via the communication interface 107. For example, the one or more processors 102 may transmit a challenge response to the application 115 including instructions executing on the third device 117 via the communication interface 107.

[0039] The one or more processors 102 may decrypt the encrypted test. For example, the one or more processors 102 may use a private key to decrypt the encrypted test to generate a decrypted test. In some examples, the one or more processors 102 may include the decrypted test in a challenge response transmitted via the communication interface 107. In some examples, the one or more processors 102 may transmit the challenge response including the decrypted test to the first application 110 via the communication interface 107, the challenge response including the decrypted test, the first application 110 including instructions to execute on the second device 112. In other examples, the one or more processors 102 may transmit the challenge response including the decrypted test to the second application 111 via the communication interface 107, the challenge response including the decrypted test, the second application 111 including instructions to execute on the second device 112. In other examples, the one or more processors 102 may transmit the challenge response including the decrypted test to the application 115 via the communication interface 107, the challenge response including the decrypted test, the third application 117 including instructions to execute on the third device 117.

[0040] The second device 112 and / or the third device 117 may be in data communication with one or more servers 125 and / or one or more databases 130. In some examples, the first application 110 and the second application 111 including instructions executing on the second device 112 may be in data communication with one or more servers 125 and / or one or more databases 130 over the network 120. The application 115 including instructions executing on the third device 117 may be in data communication with one or more servers 125 and / or one or more databases 130 over the network 120. The server 125 may receive one or more challenges including instructions to execute on the third device 117 from the application 115 including instructions to execute on the third device 117. The application 115 may transmit one or more challenges including instructions to execute on the third device 117 to the server 125. The challenge may include a public key and an encrypted test. The server 125 may include instructions to execute on the third device 117 and send one or more responses to the application 115 in response to the one or more challenges. The server 125 may generate a decrypted test by decrypting the encrypted test using the private key. Additionally, the server 125 may include the decrypted test in the challenge response.

[0041] In some examples, the card reader can provide access to one or more resources, such as a physical space. As mentioned above, the card reader may be internal to the second device 112. In other examples, the card reader may be external to the second device 112, such as part of the third device 117. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the physical space after one or more entries of the communication interface 107 into the communication field of a device, such as the device 112 or device 117 associated with the card reader. Without limitation, the physical space can include any space, such as a building, school, store, business, government agency, room, elevator, hallway, garage, etc., to which the card reader grants access via one or more entries that are part of the token validation. In some examples, the physical space can also include any space or location where mobile devices, such as cell phones, tablets, laptops, Universal Serial Bus devices, etc., are restricted or prohibited, such as a cloud server facility, government facility, or other secure facility. In some examples, a physical space may also include storage facilities, such as warehouses, storage rooms, closets, lockers, or cabinets, for storing items such as documents, merchandise, and other objects. In some examples, a physical space may also include hazardous areas or containers, such as laboratories, biological material storage, chemical storage, or rooms containing tools or hazardous equipment.

[0042] In some examples, the card reader may provide access to the digital experience. As described above, the card reader may be internal to the second device 112. In other examples, the card reader may be external to the second device 112, such as part of the third device 117. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the digital experience after one or more entries of the communication interface 107 into a communication field of a device, such as the device 112 or device 117, associated with the card reader. Without limitation, the digital experience may be associated with any application that includes instructions to execute on any device, a virtual reality program, a mobile or web browser, an email client, a game, etc.

[0043] In some examples, the card reader may provide access to the ticketed event. As described above, the card reader may be internal to the second device 112. In other examples, the card reader may be external to the second device 112, such as part of a third device 117. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the ticketed event after one or more entries of the communication interface 107 into a communication field of a device, such as the device 112 or device 117, associated with the card reader. Without limitation, the ticketed event may be associated with a school event, a sporting event, a concert event, a private event, a government event, a music event, and the like.

[0044] In some examples, the card reader may provide access to the safe deposit box. As described above, the card reader may be internal to the second device 112. In other examples, the card reader may be external to the second device 112, such as part of the third device 117. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the safe deposit box after one or more entries of the communication interface 107 into a communication field of a device, such as the device 112 or device 117, associated with the card reader. In some examples, the card reader may be external to the safe deposit box. In other examples, the card reader may be internal to the safe deposit box. In some examples, the safe deposit box may include a storage enclosure that stores one or more items, such as products or foodstuffs, available for access to the one or more items that can be removed.

[0045] In some examples, the card reader may provide access to another device, such as a network-enabled computer. In other examples, the card reader may provide access to a secure or offline computer that communicates only with the card reader. The card reader may read the access token from the first device 105 and pass it to the reader. The card reader may share the access token with the authentication system 100 or provide access to the authentication system 100. As previously mentioned, the user may access the authentication system 100 as long as the authentication system 100 honors the access token through a protocol such as OAuth or SAML.

[0046] Figure 2A illustrates one or more first devices 200. The first devices 200 may refer to elements that are the same as or similar to the first devices 105, as described above with respect to Figure 1. Figures 2A and 2B illustrate a single example of elements of the first device 200, although any number of elements may be utilized.

[0047] The first device 200 may be configured to communicate with one or more elements of the system 100. The first device 200 may include a contact or contactless card, which may include a payment card, such as a credit card, a debit card, or a gift card, issued by a service provider 205 that is displayed on the front or back of the card 200. In some examples, the contactless card 200 is not related to a payment card and may include, but is not limited to, an identification card, a membership card, or a transportation card. In some examples, the payment card may comprise a dual interface contactless payment card. The contactless card 200 may include a substrate 210 that may include a single layer or one or more laminated layers of plastic, metal, and other materials. Examples of substrate materials include polyvinyl chloride, polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, and biodegradable materials. In some examples, contactless card 200 may have physical characteristics that conform to the ID-1 format of the ISO / IEC 7810 standard, and contactless cards may also conform to the ISO / IEC 14443 standard. However, it is understood that contactless card 200 according to the present disclosure may have different characteristics, and the present disclosure does not require that the contactless card be implemented as a payment card.

[0048] The contactless card 200 may also include identification information 215 displayed on the front and / or back of the card, and a contact pad 220. The contact pad 220 may establish contact with another communication device, including, but not limited to, a user device, a smart phone, a laptop, desktop, or a tablet computer. The contactless card 200 may also include processing circuitry, an antenna, and other elements not shown in FIG. 2A. These elements may be located behind the contact pad 220 or elsewhere on the substrate 210. The contactless card 200 may also include a magnetic strip or tape that may be located on the back of the card (not shown in FIG. 2A).

[0049] As shown in Figure 2B, the contact pad 220 of Figure 2A may include processing circuitry 225, including a processor 230, such as a microprocessor, and memory 235, to store and process information. It will be understood that processing circuitry 225 may include additional elements including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware necessary to perform the functions described herein.

[0050] The memory 235 may be a read-only memory, a write-once-read-multiple-times memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the contactless card 200 may include one or more of these memories. Read-only memory may be programmable as read-only at the factory or programmable only once. One-time programmability allows it to be written once and read multiple times. Write-once-read-multiple-times memory may be programmed at some point after the factory. Once programmed, the memory cannot be rewritten, but it can be read multiple times. Read / write memory may be programmed and reprogrammed multiple times after the factory, and may also be read multiple times.

[0051] The memory 235 may store one or more applets 240, one or more counters 245, and a customer identifier 250. The one or more applets 240 may include one or more software applications that run on one or more contactless cards, such as Java Card applets. However, it will be understood that the applet 240 is not limited to a Java Card applet and may be any software application operable on a contactless card or other device with limited memory. The one or more counters 245 may comprise a numeric counter sufficient to store an integer number. The customer identifier 250 may include a unique alphanumeric identifier assigned to a user of the contactless card 200, which identifier may distinguish a user of the contactless card from other contactless card users. In some examples, the customer identifier 250 may identify both a customer and an account assigned to the customer, and may further identify a contactless card associated with the customer's account.

[0052] Although the processor and memory elements of the foregoing exemplary embodiments are described with reference to contact pads, the disclosure is not so limited, and it will be understood that these elements may be implemented outside of the pads 220, may be implemented completely separate from the pads 220, or may be implemented as additional elements in addition to the processor 230 and memory 235 elements located within the contact pads 220.

[0053] In some examples, the contactless card 200 may include one or more antennas 255. The one or more antennas 255 may be disposed within the contactless card 200 and around the processing circuit 225 of the contact pad 220. The one or more antennas 255 may be integral with the processing circuit 225, or the one or more antennas 255 may be used with an external booster coil. As another example, the one or more antennas 255 may be external to the contact pad 220 and the processing circuit 225.

[0054] In one embodiment, the coil of the contactless card 200 may function as the secondary of an air-core transformer. The terminal may communicate with the contactless card 200 by interrupting the power or amplitude modulation. The contactless card 200 may use a gap in the power connection of the contactless card to infer data sent from the terminal, which may be functionally maintained by one or more capacitors. The contactless card 200 may return communication by switching the load or load modulation of the coil of the contactless card. Load modulation may be detected on the terminal coil due to interference.

[0055] Figure 3 illustrates a method of authentication 300. Figure 3 may reference elements that are the same as or similar to the system 100 and the first device 200 illustrated in Figures 2A and 2B.

[0056] At block 305, the method 300 may include generating a ciphertext using the at least one key and the counter value. For example, one or more processors of the first device may generate a ciphertext using the at least one key and the counter value. The ciphertext may include the counter value and the transmission data. The first device may include a memory including one or more keys including the at least one key, the counter value, and the transmission data. The first device may further include a communication interface.

[0057] At block 310, the method 300 may include transmitting the ciphertext. For example, the one or more processors may transmit the ciphertext via a communication interface. For example, the one or more processors may transmit the ciphertext to one or more applications. In some examples, the one or more processors may transmit the ciphertext to a first application that includes instructions to execute on a second device.

[0058] At block 315, the method 300 may include updating the counter value. For example, the one or more processors may update the counter value after transmitting the ciphertext.

[0059] At block 320, the method 300 may include receiving an encrypted access token via the communication interface. For example, the one or more processors may receive the access token via the communication interface. In some examples, the one or more processors may receive the access token from a first application. In some examples, the access token may be generated and / or encrypted by the first application. In some examples, the access token may be generated when the user authenticates to a first or primary system. The first or primary system may include an application or a network login. The application may include, but is not limited to, a first application that includes instructions executed on the second device. At that point, an access token may be generated that encapsulates the security identity established by presenting one or more credentials including, but not limited to, at least one selected from the group of a username and / or password, a mobile device number, an account number, a card number, and biometric authentication (e.g., face scan, retina scan, fingerprint, voice input for voice recognition, etc.). The database that is initially authenticated may generate the token. In this model, the access token is encrypted and transmitted to the first device and securely stored. When a user wishes to access a second system, the first device may be presented and the second system may interrogate it. As long as the access token is still valid and the first and second systems are mutually respectful, the user may access the secondary system through a protocol such as OAuth or SAML. In some examples, the access token may be encrypted before transmission. For example, the first application may encrypt the access token before sending it to one or more processors on the first device.

[0060] At block 325, the method 300 may include decrypting the encrypted access token. For example, the one or more processors may decrypt the access token.

[0061] At block 330, the method 300 may include storing the decrypted access token. For example, the one or more processors may store the access token in a memory.

[0062] At block 335, the method 300 may include transmitting an access token for authentication to receive access to one or more resources after the communication interface enters a communication field. For example, the one or more processors may transmit the access token after one or more entries of the communication interface into the communication field of any device. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. For example, the one or more processors may transmit the access token to the first application. The access token may be transmitted via Near Field Communication (NFC). Without limitation, the access token can be transmitted via Bluetooth, Wi-Fi, RFID.

[0063] In another example, the one or more processors may transmit the access token to a second application that includes instructions to execute on the second device. The one or more processors may transmit the access token after one or more entries of a communication interface into a communication field of the second device. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. For example, the one or more processors may transmit the access token to the second application. The access token may be transmitted via Near Field Communication (NFC). Without limitation, the access token can be transmitted via Bluetooth, Wi-Fi, RFID.

[0064] In another example, the one or more processors may send the access token to an application including instructions to execute on the third device. The one or more processors may send the access token after the communication interface makes one or more entries into a communication field of the third device. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. The access token may be sent via Near Field Communication (NFC). Without limitation, the access token can be sent via Bluetooth, Wi-Fi, RFID.

[0065] The access token may be sent for validation before providing access to one or more resources. For example, an application including instructions executing on a third device may receive the access token from the one or more processors and validate the access token by sending one or more requests to one or more servers. The one or more servers may receive one or more requests from the application including instructions executing on the third device. The one or more requests may include the access token. The one or more servers may validate the access token by comparison with a reference access token and determine if a match is successful. In some examples, the server may validate the access token. If the comparison of the access token to the reference access token results in a match, the access token is validated and access to the one or more resources is provided. If the comparison of the access token to the reference access token does not result in a match, access to the one or more resources may proceed further in the following manner. For example, based on the determination of an unsuccessful match, access to the one or more resources may be denied. In other examples, access to the one or more resources may be retried up to a number of times including a predetermined threshold number of times by resending and rereceiving the access token before denying access to the one or more resources. In this manner, access to one or more resources may be denied and / or authorization privileges may be revoked after the token has been used, as described further below.

[0066] In some examples, the database may validate the access token. For example, one or more servers may validate the access token by sending one or more requests to the database. The one or more requests may include the access token. The database may receive the one or more requests from the one or more servers. The database may validate the access token by comparison with a reference access token to determine if a match is successful. If the comparison of the access token to the reference access token results in a match, the access token is validated and access to the one or more resources is provided. If the comparison of the access token to the reference access token does not result in a match, access to the one or more resources may proceed further in the following manner. In some examples, based on the determination of an unsuccessful match, access to the one or more resources may be denied. In other examples, the request for access to the one or more resources may be retried up to a predetermined threshold number of times by resending and rereceiving the access token before denying access to the one or more resources. In this manner, access to one or more resources may be denied and / or authorization privileges may be revoked after use of the token, as described further below.

[0067] The access token may include a limited-use token. The access token may include one or more elements, such as an access identifier. The access identifier may be capable of identifying a user across multiple systems, such as a first system and a second system. The access identifier may be unique to the user, associated with a login session, and / or a combination thereof. In some examples, the access identifier may include a group of identifiers that may indicate the user as belonging to one or more access groups. In some examples, the token may include a single-use token. In other examples, the token may include a time-based token. For example, the token may be limited to use for a predetermined period of time, such as at least one selected from the group of seconds, minutes, hours, days, weeks, months, years, and / or any combination thereof. After the token is used, such as after a single use and / or after the predetermined period of use has expired, the token may be disabled and no longer usable.

[0068] In some examples, the first application including instructions to execute on the second device may be a different application than the second application including instructions to execute on the second device. In some examples, the second device may be a different device than the third device. In some examples, the third device may be external to the second device. For example, the third device may not be part of the third device. In some examples, the third device may be integral with the second device. For example, the third device may be part of the second device or may be internal to the second device. The third device may include a reader, such as a card reader. In some examples, the card reader may provide access to a physical space. In some examples, the card reader may provide access to a digital experience. In some examples, the card reader may provide access to a ticketed event. In some examples, the card reader may provide access to a safe deposit box.

[0069] In another example, the one or more processors may receive one or more challenges from the first application over the communications interface, the challenges including instructions to execute on the second device. The challenges may include a public key and an encrypted test. The one or more processors may transmit one or more responses to the one or more challenges over the communications interface. For example, the one or more processors may transmit a challenge response to the first application over the communications interface, the challenge response including instructions to execute on the second device.

[0070] In another example, the one or more processors may receive one or more challenges via the communications interface. For example, the one or more processors may receive a challenge from an application that includes instructions to execute on the third device. The challenge may include a public key and an encrypted test. The one or more processors may send one or more responses in response to the one or more challenges via the communications interface. For example, the one or more processors may send a challenge response to the application that includes instructions to execute on the third device via the communications interface.

[0071] The one or more processors may decrypt the encrypted test. For example, the one or more processors may decrypt the encrypted test using a private key to generate a decrypted test. In some examples, the one or more processors may include the decrypted test in a challenge response transmitted over the communications interface. In some examples, the one or more processors may transmit, over the communications interface, the challenge response including the decrypted test to a first application including instructions to execute on a second device. In other examples, the one or more processors may transmit, over the communications interface, the challenge response including the decrypted test to a second application including instructions to execute on a second device. In other examples, the one or more processors may transmit, over the communications interface, the challenge response including the decrypted test to an application including instructions to execute on a third device.

[0072] The second device and / or the third device may be in data communication with one or more servers and / or one or more databases. In some examples, the first application and the second application including instructions executing on the second device may be in data communication with one or more servers and / or one or more databases. The application including instructions executing on the third device may be in data communication with one or more servers and / or one or more databases. The server may receive one or more challenges from the application including instructions executing on the third device. The application including instructions executing on the third device may send one or more challenges to the server. The challenge may include a public key and an encrypted test. The server may send one or more responses to the application including instructions executing on the third device and responsive to the one or more challenges. The server may generate a decrypted test by decrypting the encrypted test using the private key. Further, the server may include the decrypted test in the challenge response.

[0073] In some examples, the card reader may provide access to one or more resources, such as a physical space. As mentioned above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the physical space after one or more entries of a communication interface into a communication field of a device associated with the card reader. Without limitation, the physical space may include any space, such as a building, school, store, business, government agency, room, elevator, hallway, garage, etc., to which the card reader grants access via one or more entries that are part of the token validation. In some examples, the physical space may also include any space or location where mobile devices, such as cell phones, tablets, laptops, Universal Serial Bus devices, etc., are restricted or prohibited, such as a cloud server facility, government facility, or other secure facility. In some examples, the physical space may also include a storage facility, such as a warehouse, storage room, closet, locker, or cabinet, that stores items, such as documents, merchandise, and other goods. In some examples, the physical space may also include hazardous areas or containers, such as laboratories, biological material storage, chemical storage, or rooms containing tools or hazardous equipment.

[0074] In some examples, the card reader may provide access to the digital experience. As described above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the digital experience after one or more entries of a communication interface into a communication field of a device associated with the card reader. Without limitation, the digital experience may be associated with any application that includes instructions to execute on any device, a virtual reality program, a mobile or web browser, an email client, a game, etc.

[0075] In some examples, the card reader may provide access to the ticketed event. As discussed above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the ticketed event after one or more entries of a communication interface into a communication field of a device associated with the card reader. Without limitation, the ticketed event may be associated with a school event, a sporting event, a concert event, a private event, a government event, a music event, etc.

[0076] In some examples, the card reader may provide access to the safe deposit box. As described above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the safe deposit box after one or more entries of a communication interface into a communication field of a device associated with the card reader. In some examples, the card reader may be external to the safe deposit box. In other examples, the card reader may be internal to the safe deposit box. In some examples, the safe deposit box may include a storage enclosure that stores one or more items, such as products or foodstuffs, available for access to the one or more items that can be removed.

[0077] 4 shows an example of a sequence diagram 400 of an authentication process according to an embodiment. FIG. 4 may refer to elements that are the same as or similar to the system 100 of FIG. 1, the first device 200 of FIG. 2A and FIG. 2B, and the method 300 of FIG. 3.

[0078] In step 405, the one or more processors may transmit the ciphertext via the communication interface. For example, the one or more processors of the first device may generate the ciphertext using at least one key and a counter value. The ciphertext may include a counter value and transmission data. The first device may include a memory including one or more keys including at least one key, a counter value, and the transmission data. The first device may further include a communication interface. For example, the one or more processors may transmit the ciphertext via the communication interface. For example, the one or more processors may transmit the ciphertext to one or more applications of the user device or the second device. In some examples, the one or more processors may transmit the ciphertext to a first application including instructions to execute on the second device.

[0079] In step 410, the application of the user device or the second device may transmit the encrypted first token. For example, the application of the user device may transmit the encrypted first token over the communication interface after verifying the cryptogram. The encrypted first token may include an encrypted access token. In some examples, the access token may be generated and / or encrypted by the first application. In some examples, the access token may be generated when the user authenticates to the first or primary system, which may include a first application including instructions to execute on the second device, or an application including, but not limited to, a network login. At that point, an access token may be generated that encapsulates the security identity established by presenting one or more credentials including, but not limited to, at least one selected from the group of username and / or password, mobile device number, account number, card number, and biometric authentication (e.g., face scan, retina scan, fingerprint, voice input for voice recognition, etc.). The database that is initially authenticated may generate the token. In this model, the access token is encrypted and transmitted to the first device and securely stored. When a user wishes to access a second system, the first device may be presented and the second system may interrogate it. As long as the access token is still valid and the first and second systems are mutually respectful, the user may access the secondary system through a protocol such as OAuth or SAML. In some examples, the access token may be encrypted before transmission. For example, the first application may encrypt the access token before sending it to one or more processors on the first device.

[0080] The first token may include a limited-use token. The access token may include one or more elements, such as an access identifier. The access identifier may identify a user across multiple systems, such as a first system and a second system. The access identifier may be unique to the user, associated with a login session, and / or a combination thereof. In some examples, the access identifier may include a group of identifiers that may indicate the user as belonging to one or more access groups. In some examples, the token may include a single-use token. In other examples, the token may include a time-based token. For example, the token may be limited to use for a predetermined period of time, such as at least one selected from the group of seconds, minutes, hours, days, weeks, months, years, and / or any combination thereof. After the token is used, such as after a single use and / or after the predetermined period of use has expired, the token may be disabled and no longer usable.

[0081] In step 415, the one or more processors may decrypt and store the encrypted first token in memory. For example, the one or more processors may receive the encrypted first token from an application on the user device via a communications interface. The decrypted first token may be stored in the memory of the first device.

[0082] In step 420, the one or more processors may transmit the first token to the reader after the communication interface enters the communication field of the reader. As previously described, the reader may be external to the user device. In other examples, the reader may be internal to the user device. The reader may be a device different from the user's device. The reader may include an application that includes instructions to execute that is different from the application that includes instructions to execute on the user device. The reader may read one or more messages from a tag, such as an NFC tag, from the first device.

[0083] The one or more processors may transmit the first token to an application including instructions to execute on a third device, such as a reader. The one or more processors may transmit the access token after the communication interface makes one or more entries into a communication field of the third device. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. The access token may be transmitted via Near Field Communication (NFC). Without limitation, the access token can be transmitted via Bluetooth, Wi-Fi, RFID.

[0084] In step 425, the reader may send one or more challenges to the one or more processors. For example, the one or more processors may receive one or more challenges from the reader via a communication interface. For example, the one or more processors may receive a challenge from an application that includes instructions to execute on the third device. The challenge may include a public key and an encrypted test.

[0085] At step 430, the one or more processors may transmit one or more challenge responses to the reader in response to the one or more challenges. For example, the one or more processors may transmit one or more responses in response to the one or more challenges to the reader via the communication interface. For example, the one or more processors may transmit the challenge response including instructions to execute on the third device to an application via the communication interface. The one or more processors may decrypt the encrypted test. For example, the one or more processors may decrypt the encrypted test using a private key to generate a decrypted test. In some examples, the one or more processors may include the decrypted test in the challenge response transmitted via the communication interface. For example, the one or more processors may transmit the challenge response including the decrypted test to an application including instructions to execute on the third device via the communication interface.

[0086] At step 435, the reader may authenticate one or more challenge responses to grant access to one or more resources. In some examples, the card reader may provide access to a physical space. In some examples, the card reader may provide access to a digital experience. In some examples, the card reader may provide access to a ticketed event. In some examples, the card reader may provide access to a safe deposit box.

[0087] In some examples, the card reader may provide access to one or more resources, such as a physical space. As mentioned above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the physical space after one or more entries of a communication interface into a communication field of a device associated with the card reader. Without limitation, the physical space may include any space, such as a building, school, store, business, government agency, room, elevator, hallway, garage, etc., to which the card reader grants access via one or more entries that are part of the token validation. In some examples, the physical space may also include any space or location where mobile devices, such as cell phones, tablets, laptops, Universal Serial Bus devices, etc., are restricted or prohibited, such as a cloud server facility, government facility, or other secure facility. In some examples, the physical space may also include a storage facility, such as a warehouse, storage room, closet, locker, or cabinet, that stores items, such as documents, merchandise, and other goods. In some examples, the physical space may also include hazardous areas or containers, such as laboratories, biological material storage, chemical storage, or rooms containing tools or hazardous equipment.

[0088] In some examples, the card reader may provide access to the digital experience. As described above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the digital experience after one or more inputs of a communication interface into a communication field of a device associated with the card reader. Without limitation, the digital experience may be associated with any application that includes instructions to execute on any device, a virtual reality program, a mobile or web browser, an email client, a game, etc.

[0089] In some examples, the card reader may provide access to the ticketed event. As discussed above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the ticketed event after one or more entries of a communication interface into a communication field of a device associated with the card reader. Without limitation, the ticketed event may be associated with a school event, a sporting event, a concert event, a private event, a government event, a music event, etc.

[0090] In some examples, the card reader may provide access to the safe deposit box. As described above, the card reader may be internal to the second device. In other examples, the card reader may be external to the second device, such as part of a third device. For example, access may be provided after successful authentication of the token. In some examples, the card reader may provide access to the safe deposit box after one or more entries of a communication interface into a communication field of a device associated with the card reader. In some examples, the card reader may be external to the safe deposit box. In other examples, the card reader may be internal to the safe deposit box. In some examples, the safe deposit box may include a storage enclosure that stores one or more items, such as products or foodstuffs, available for access to the one or more items that can be removed.

[0091] FIG 5 illustrates an example of an authentication system 500 according to an embodiment. FIG 5 may reference elements that are the same as or similar to the system 100, the first device 200 of FIG 2A and FIG 2B, the method 300 of FIG 3, and the sequence diagram 400 of FIG 4. The authentication system 500 may include a first device 505, a second device 510, and a network 515. Although FIG 5 illustrates a single example of elements of the system 500, the system 500 may include any number of elements.

[0092] The system 500 may include a first device 505. The first device 505 may include a contactless card, a contact card, or other devices described herein. As previously described, the first device 505 may include one or more processors 502 and a memory 504. The memory 504 may include one or more applets 506 and one or more counters 508. Each counter 508 may include a counter value. The memory 504 may include a counter value, transmission data, and at least one key.

[0093] The first device 505 may include a communication interface 507. The communication interface 507 may include communication capabilities with a physical interface and a contactless interface. For example, the communication interface 507 may communicate with the physical interface by swiping through a card swipe interface or by inserting into a card chip reader on an automated teller machine (ATM) or other device that communicates through the physical interface. In other examples, the communication interface 507 may be configured to establish contactless communication with a card reader through near-field wireless communication methods such as NFC, Bluetooth, Wi-Fi, RFID, and other forms of contactless communication. As shown in FIG. 5, the communication interface 507 may directly communicate with the second device 510 through a network 515.

[0094] The first device 505 can be in data communication with any number of elements of the system 100. For example, the first device 505 can transmit data to the second device 510 over the network 515. The first device 505 can transmit and / or receive data over the network 515. In some examples, the first device 505 may transmit data over the network 515 after the communication interface 507 enters one or more communication fields of any device. Without limitation, each entry can be associated with a tap, a swipe, a wave, and / or any combination thereof.

[0095] The system 500 may include a second device 510. The second device 510 may include one or more processors 512, a memory 514, and a reader 519. The memory 514 may include one or more applications, including but not limited to a first application 516 and a second application 518. The reader 519 may read one or more messages from a tag, such as an NFC tag, from the first device 505. The second device 510 may be in data communication with any number of elements of the system 500. For example, the second device 510 may transmit and / or receive data to and from the first device 505 via a network 515. Without limitation, the second device 510 may be a network-enabled computer. As referred to herein, a network-enabled computer includes any computing or communication device, including, but not limited to, a server, network appliance, personal computer, workstation, telephone, handheld PC, personal digital assistant, contactless card, thin client, fat client, Internet browser, kiosk, tablet, terminal, or other device. The second device 510 may be a mobile device. For example, the mobile device may include an Apple® iPhone®, iPod®, iPad®, or other mobile device running Apple's iOS® operating system, any device running Microsoft®'s Windows® mobile operating system, any device running Google's Android® operating system, or other smartphone, tablet, or similar wearable mobile device.

[0096] The second device 510 may include processing circuitry and may include additional elements including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware as necessary to perform the functions described herein. The second device 510 may further include a display device and an input device. The display may be any type of device that presents visual information, such as a computer monitor, a flat panel display, a liquid crystal display, a light emitting diode display, a plasma panel, a mobile device screen including a cathode ray tube display. The input device may include any device available and supported by the user's device for inputting information into the user's device, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder or camcorder. These devices may be used to input information and interact with the software and other devices described herein.

[0097] The system 500 may include a network 515. In some examples, the network 515 may be one or more of a wireless network, a wired network, or any combination of wireless and wired networks and may be connected to any one of the elements of the system 500. For example, the first device 505 may be connected to the device 510 via the network 515. In some examples, the network 515 may include one or more of a fiber optic network, a passive optical network, a cable network, an Internet network, a satellite network, a wireless local area network (LAN), a global system for mobile communications, a personal communication service, a personal area network, a wireless application protocol, a multimedia messaging service, an enhanced messaging service, a short message service, a time division multiplexing based system, a code division multiple access based system, a D-AMPS, Wi-Fi, fixed wireless data, IEEE 802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth, NFC, radio frequency identification (RFID), Wi-Fi, and the like.

[0098] Further, network 515 may include a global network, such as, but not limited to, telephone lines, optical fiber, IEEE Ethernet 902.3, wide area networks, wireless personal area networks, LANs, or the Internet. Furthermore, network 515 may support an Internet network, a wireless communication network, a cellular network, or the like, or any combination thereof. Network 515 may further include one network, or any number of the exemplary types of networks described above, operating as a standalone network or in conjunction with one another. Network 515 may utilize one or more protocols of one or more network elements to which they are communicatively coupled. Network 515 may translate from other protocols to one or more protocols of the network devices. Although network 515 is shown as a single network, according to one or more examples, it will be understood that network 515 may include multiple interconnected networks, such as, for example, the Internet, a service provider's network, a cable television network, an enterprise network such as a credit card association network, and a home network.

[0099] In some examples, the exemplary procedures according to the present disclosure described herein may be executed by a processing device and / or computing device (e.g., computer hardware device). Such a processing / computing device may be all, part, or include a computer / processor, including, but not limited to, one or more microprocessors, and may utilize instructions stored on a computer-accessible medium (e.g., RAM, ROM, hard drive, or other storage device). For example, the computer-accessible medium may be part of the memory of the first device 505, or other computer hardware configuration.

[0100] In some examples, a computer-accessible medium (e.g., a storage device such as a hard disk, floppy disk, memory stick, CD-ROM, RAM, ROM, or combination thereof, as described above herein) may be provided (e.g., in communication with a processing device). The computer-accessible medium may include executable instructions. Additionally or alternatively, a storage device may be provided separately from the computer-accessible medium, and the storage device may provide instructions to the processing device to perform certain example procedures, processes, and methods as described above herein.

[0101] The one or more processors 502 may generate a cryptogram using at least one of the key and the counter value. The cryptogram may include the counter value and the transmission data. The one or more processors 502 may transmit the cryptogram via the communication interface 507. For example, the one or more processors 502 may transmit the cryptogram to one or more applications for verification. In some examples, the one or more processors 502 may transmit the cryptogram including instructions to execute on the second device 510 to the first application 516. The one or more processors 502 may update the counter value after transmitting and verifying. of the cryptogram. The one or more processors 502 may receive an access token via the communication interface 507 after verifying the cryptogram. For example, the one or more processors 502 may receive the access token from the first application 516. In some examples, the access token may be generated and / or encrypted by the first application 516. In some examples, an access token may be generated when a user authenticates to a first or primary system, including, but not limited to, a first application 516 including instructions executing on a first device 510, or a network login associated with a network 515. At that point, an access token may be generated to encapsulate a security identity established through one or more credentials including, but not limited to, at least one selected from the group of a username and / or password, a mobile device number, an account number, a card number, and biometric authentication (e.g., face scan, retina scan, fingerprint, voice input for voice recognition, etc.). A database may also be included in the system 500 and may first authenticate and generate the token. In this model, the access token is encrypted and sent to the first device 505 for secure storage. When the user wishes to access a second system, the first device 505 may be presented and the second system may query it. As long as the access token is still valid and the first and second systems respect each other through protocols such as OAuth or SAM, the user may access the secondary system.In some examples, the access token may be encrypted before transmission. For example, the first application 516 may encrypt the access token before transmitting it to the one or more processors 502 of the first device 505.

[0102] The one or more processors 502 may decode the access token. The one or more processors 502 may store the access token in the memory 504. The one or more processors 502 may transmit the access token after transmitting one or more entries of the communication interface 507 to a communication field of any device. The access token. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. For example, the one or more processors 502 may transmit the access token to the first application 516. The access token may be transmitted via Near Field Communication (NFC). Without being limited thereto, the access token may be transmitted via Bluetooth, Wi-Fi, RFID.

[0103] The one or more processors 502 may transmit the access token to a second application 518 that includes instructions to execute on the second device 510. The one or more processors 502 may transmit after one or more entries of the access token. The access token is transmitted to a communication field of the second device 510 via the communication interface 507. The one or more entries may be associated with at least one selected from the group of a tap, a swipe, a wave, and / or any combination thereof. For example, the one or more processors 102 may transmit the access token to the second application 518. The access token may be transmitted via Near Field Communication (NFC). Without being limited thereto, the access token may be transmitted via Bluetooth, Wi-Fi, RFID. As previously mentioned, the access token may be transmitted for validation before providing access to one or more resources.

[0104] The access token may include a limited-use token. The access token may include one or more elements, such as an access identifier. The access identifier may identify a user across multiple systems, such as a first system and a second system. The access identifier may be unique to the user, associated with a login session, and / or a combination thereof. In some examples, the access identifier may include a group of identifiers that may indicate the user as belonging to one or more access groups. In some examples, the token may include a single-use token. In other examples, the token may include a time-based token. For example, the token may be limited to use for a predetermined period of time, such as at least one selected from the group of seconds, minutes, hours, days, weeks, months, years, and / or any combination thereof. After the token is used, such as after a single use and / or after the predetermined period of use has expired, the token may be disabled and no longer usable.

[0105] In some examples, a first application 516 including instructions to execute on the second device 510 may be a different application than a second application 518 including instructions to execute on the second device 510. In some examples, a card reader 519 may provide access to a physical space. In some examples, a card reader 519 may provide access to a digital experience. In some examples, a card reader 519 may provide access to a ticketed event. In some examples, a card reader 519 may provide access to a safe deposit box.

[0106] In another example, the one or more processors 502 may receive one or more challenges from the first application 516 or the second application 518 via the communication interface 507, the challenges including instructions to execute on the second device 510, the public key and the encrypted test. The one or more processors 502 may transmit one or more responses in response to the one or more challenges via the communication interface 507. For example, the one or more processors 502 may transmit a challenge response including instructions to execute on the second device 510 to the first application 516 or the second application 518 via the communication interface 507.

[0107] The one or more processors 502 may decrypt the encrypted test. For example, the one or more processors 502 may decrypt the encrypted test using a private key to generate a decrypted test. In some examples, the one or more processors 502 may include the decrypted test in a challenge response transmitted via the communication interface 507. In some examples, the one or more processors 502 may transmit the challenge response via the communication interface 507 including the decrypted test to the first application 516 or the second application 518 including instructions to execute on the second device 510.

[0108] In some examples, the card reader 519 may provide access to one or more resources, such as a physical space. As mentioned above, the card reader may be internal to the second device 510. For example, access may be provided after successful authentication of the token. In some examples, the card reader 519 may provide access to the physical space after one or more entries of the communication interface 507 into the communication field of a device, such as the device 510 associated with the card reader 519. Without being limited thereto, the physical space may include any space, such as a building, school, store, business, government agency, room, elevator, hallway, garage, etc., to which the card reader grants access via one or more entries that are part of the token validation. In some examples, the physical space may also include any space or location where mobile devices, such as cell phones, tablets, laptops, Universal Serial Bus devices, etc., are restricted or prohibited, such as a cloud server facility, government facility, or other secure facility. In some examples, the physical space may also include a storage facility, such as a warehouse, storage room, closet, locker, or cabinet, that stores items, such as documents, merchandise, and other goods. In some examples, the physical space may also include hazardous areas or containers, such as laboratories, biological material storage, chemical storage, or rooms containing tools or hazardous equipment.

[0109] In some examples, the card reader 519 may provide access to the digital experience. As described above, the card reader may be internal to the second device 510. For example, access may be provided after successful authentication of the token. In some examples, the card reader 519 may provide access to the digital experience after one or more inputs of the communication interface 507 into a communication field of a device, such as the device 510 associated with the card reader 519. For example, the digital experience may be associated with any application that includes instructions to execute on any device, a virtual reality program, a mobile or web browser, an email client, a game, etc. In some examples, the first application 516 may generate and send an access token to the first device 505, and the second application 518 may be associated with the digital experience.

[0110] In some examples, the card reader 519 may provide access to the ticketed event. As described above, the card reader may be internal to the second device 510. For example, access may be provided after successful authentication of the token. In some examples, the card reader 519 may provide access to the ticketed event after one or more entries of the communication interface 507 into a communication field of a device, such as the device 510 associated with the card reader 519. For example, the ticketed event may be associated with a school event, a sporting event, a concert event, a private event, a government event, a music event, etc.

[0111] In some examples, the card reader 519 may provide access to the safe deposit box. As described above, the card reader 519 may be internal to the second device 510. For example, access may be provided after successful authentication of the token. In some examples, the card reader 519 may provide access to the safe deposit box after one or more inputs of the communication interface 507 into a communication field of a device, such as the device 510 associated with the card reader 519. In some examples, the card reader may be external to the safe deposit box. In some examples, the safe deposit box may include a storage enclosure that stores one or more items, such as products or groceries, available for access to the one or more items that can be removed.

[0112] Figure 6 illustrates an example method 600 of authentication according to an embodiment. Figure 6 may reference elements that are the same or similar to the system 100 of Figure 1, the first device 200 of Figures 2A and 2B, the method 300 of Figure 3, the sequence diagram 400 of Figure 4, and the system 500 of Figure 5.

[0113] At block 605, the method 600 may include sending a challenge including the public key and the encrypted test. For example, an application including instructions executing on a device, such as a client device or a card reader, may send one or more challenges via a communication interface of the first device. One or more processors of the first device may receive one or more challenges via the communication interface from an application including instructions executing on the device. The challenge may include the public key and the encrypted test. In some examples, the challenge may be sent after authentication of the token, as described above.

[0114] At block 610, the method 600 may include generating a decrypted test. For example, the one or more processors may decrypt the encrypted test. For example, the one or more processors may decrypt the encrypted test using a private key to generate the decrypted test.

[0115] At block 615, the method 600 may include including the decoded test in a challenge response. For example, the one or more processors may include the decoded test in a challenge response transmitted over a communications interface.

[0116] At block 620, the method 600 may include transmitting a challenge response. For example, the one or more processors may transmit, via the communications interface, one or more responses in response to the one or more challenges. For example, the one or more processors may transmit, via the communications interface, the challenge response including instructions to execute on a device, such as a client device or a card reader, to an application.

[0117] At block 625, the method 600 may include authenticating the challenge response. For example, an application including instructions executing on a device such as a client device or a card reader may authenticate the challenge response received from the one or more processors. In some examples, the application may determine whether the one or more responses indicate decryption of the encrypted test. For example, if the one or more responses indicate successful decryption of the encrypted test, the response may be considered authenticated. If the one or more responses indicate unsuccessful decryption of the encrypted test, the response may not be authenticated. In some examples, the one or more processors may retransmit the one or more responses including successful decryption of the encrypted test. The retransmission of the one or more responses may include a predetermined threshold number of attempts, such as one or more entries of a communication interface of the first device into one or more communication fields of the device such as a client device or a card reader, before the authentication process times out. In other examples, the retransmission of the one or more responses may be subject to a predetermined threshold period of attempts, such as one or more entries of a communication interface of the first device into one or more communication fields of the device such as a client device or a card reader, before the authentication process times out. The predetermined threshold period may include at least one selected from the group of seconds, minutes, hours, days, weeks, months, years, etc., and / or any combination thereof.

[0118] In some examples, the application may authenticate the challenge response by decrypting the response using a private key. In other examples, the application may authenticate the challenge response by sending one or more requests to one or more servers and / or one or more databases. For example, one or more servers may receive one or more authentication requests from the application. The one or more servers may decrypt the challenge response via the private key. In other examples, one or more databases may receive one or more authentication requests from the one or more servers. The one or more databases may decrypt the challenge response via the private key.

[0119] At block 630, the method 600 may include providing access to one or more resources. For example, access to the one or more resources may be conditioned on a determination of an outcome related to authentication of the challenge response. In this manner, access to the one or more resources may be denied or granted based on the determination of the authenticated challenge response. In some examples, the card reader may provide access to one or more resources, such as a physical space. As described above, the card reader may be internal to the client device. In other examples, the card reader may be external to the client device, such as part of a third device. For example, access may be provided after successful authentication of the challenge response. In some examples, the card reader may provide access to the physical space after one or more entries of a communication interface into a communication field of a device associated with the card reader. Without limitation, the physical space may include any space, such as a building, school, store, business, government agency, room, elevator, hallway, garage, etc., to which the card reader grants access via one or more entries that are part of the token validation. In some examples, a physical space may also include any space or location where mobile devices, such as cell phones, tablets, laptops, Universal Serial Bus devices, etc., are restricted or prohibited, such as a cloud server facility, government facility, or other secure facility. In some examples, a physical space may also include storage facilities, such as warehouses, storage rooms, closets, lockers, or cabinets that store items, such as documents, merchandise, and other goods. In some examples, a physical space may also include hazardous areas or hazardous material containers, such as laboratories, biological material storage, chemical storage, or rooms containing tools or hazardous equipment.

[0120] In some examples, the card reader may provide access to the digital experience. As described above, the card reader may be internal to the client device. In other examples, the card reader may be external to the client device, such as part of a third device. For example, access may be provided after successful authentication of a challenge response. In some examples, the card reader may provide access to the digital experience after one or more inputs of a communication interface into a communication field of a device associated with the card reader. Without limitation, the digital experience may be associated with any application that includes instructions to execute on any device, a virtual reality program, a mobile or web browser, an email client, a game, etc.

[0121] In some examples, the card reader may provide access to the ticketed event. As described above, the card reader may be internal to the client device. In other examples, the card reader may be external to the client device, such as part of a third device. For example, access may be provided after successful authentication of a challenge response. In some examples, the card reader may provide access to the ticketed event after one or more inputs of a communication interface into a communication field of a device associated with the card reader. Without limitation, the ticketed event may be associated with a school event, a sporting event, a concert event, a private event, a government event, a music event, etc.

[0122] In some examples, the card reader may provide access to the safe deposit box. As described above, the card reader may be internal to the client device. In other examples, the card reader may be external to the client device, such as part of a third device. For example, access may be provided after successful authentication of a challenge response. In some examples, the card reader may provide access to the safe deposit box after one or more inputs of a communication interface into a communication field of a device associated with the card reader. In some examples, the card reader may be external to the safe deposit box. In other examples, the card reader may be internal to the safe deposit box. In some examples, the safe deposit box may include a storage enclosure that stores one or more items, such as products or foodstuffs, available for access to the one or more items that can be removed.

[0123] Additionally, it should be noted that the systems and methods described herein may be embodied specifically in one or more physical media, such as, but not limited to, a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a hard drive, a read-only memory (ROM), a random access memory (RAM), and other physical media capable of storing data. For example, a data storage device may include a random access memory (RAM) and a read-only memory (ROM) that access and store data, information, and computer program instructions. A data storage device may also include an operating system, application programs, including, for example, a web browser application, an email application, and / or other applications, and a storage medium or other suitable type of memory (e.g., RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable cartridge, flash drive, any type of tangible and non-transitory storage medium) in which files, including data files, may be stored. The data storage of a network-enabled computer system may include electronic information, files, and documents stored in a variety of ways, such as flat files, indexed files, hierarchical databases, relational databases (e.g., software from Oracle® Corporation, Microsoft Excel files, Microsoft Access files, solid-state storage devices (including flash arrays, hybrid arrays, or server-side products), enterprise storage (including online or cloud storage), or other storage mechanisms. Additionally, the diagrams show various components (e.g., servers, computers, processors, etc.) separately. Functions illustrated as being performed by various components may be performed by other components, and the various components may be combined or separated.Other variations are possible.

[0124] In the foregoing specification, various embodiments have been described with reference to the accompanying drawings. It will be apparent, however, that various modifications and changes are possible and additional embodiments may be implemented without departing from the broader scope of the invention as set forth in the claims. The specification and drawings are, therefore, to be regarded in an illustrative sense and not in a restrictive sense.

Claims

1. a memory containing a counter value, transmission data, and at least one key; A communication interface; one or more processors in communication with the memory and the communication interface; The one or more processors: generating a ciphertext using the at least one key and the counter value, the ciphertext including the counter value and the transmitted data; Transmitting the ciphertext via the communication interface; updating the counter value after transmitting the ciphertext; receiving an encrypted access token via the communications interface; transmitting an encrypted access token via the communication interface after the communication interface enters the communication field to access one or more resources; The first device.

2. the one or more processors further receive, via the communications interface, a challenge including a public key and an encrypted test. The first device of claim 1 .

3. The one or more processors further transmit, in response to the challenge, a challenge response via the communications interface. The first device of claim 2 .

4. The one or more processors further generate a decoded test of the challenge response received via the communications interface; including the decrypted test in a challenge response transmitted over the communications interface; The first device of claim 2 .

5. Prior to transmitting the encrypted access token via the communications interface, the one or more processors further: Decrypting the encrypted access token; storing the decrypted access token in a memory; Encrypting the decrypted access token with the public key to generate the encrypted access token that is transmitted. The first device of claim 2 .

6. The encrypted access token is decrypted using a private key. The first device according to claim 5 .

7. each entry of said communication interface into said communication field generates a challenge; The first device of claim 1 .

8. The access token includes a limited-use token. The first device of claim 1 .

9. the access token includes an access identifier. The first device of claim 1 .

10. generating a ciphertext using the at least one key and the counter value, the ciphertext including the counter value and the transmitted data; Transmitting the ciphertext via a communication interface; updating the counter value; receiving an encrypted access token via the communications interface; transmitting the encrypted access token via the communication interface after the communication interface enters the communication field to receive access to one or more resources; Authentication method.

11. and receiving, via the communication interface, a challenge including a public key and an encrypted test. The authentication method according to claim 10.

12. The method of claim 11, further comprising the steps of: before transmitting the encrypted access token via the communication interface; Decrypting the encrypted access token; storing the decrypted access token in a memory; Encrypting the decrypted access token with the public key to generate the encrypted access token that is transmitted. The authentication method according to claim 11.

13. The encrypted access token is decrypted using a private key. The authentication method according to claim 12.

14. and transmitting a challenge response via the communication interface in response to the challenge. The authentication method according to claim 11.

15. and decrypting the encrypted test to generate a decrypted test. The authentication method according to claim 11.

16. and wherein the challenge response transmitted over the communication interface includes the decrypted test. The authentication method according to claim 15.

17. and receiving a challenge based on each entry of the communication interface into the communication field. The authentication method according to claim 11.

18. and invalidating the access token after a predetermined period of time has elapsed. The authentication method according to claim 11.

19. When executed by a processor, the processor: generating a ciphertext using one or more keys and a counter value, the ciphertext including the counter value and transmitted data; transmitting said ciphertext; updating the counter value; transmitting the encrypted access token via the communication interface after the communication interface enters the communication field; receiving access to one or more resources upon authentication of the access token; A non-transitory computer-readable medium storing instructions for performing operations including:

20. Prior to transmitting the encrypted access token over the communications interface, the operations further comprise: receiving an encrypted access token, decrypting the encrypted access token; Encrypting the decrypted access token with a public key and generating the encrypted access token to be transmitted.

20. The non-transitory computer-readable medium of claim 19,

Images