Visa International Service Association

Capital One Services, LLC

Soumendra Bhattacharya

Eric Fernand Le Saint

Mohit Gupta

Sergey Smirnoff

Hari Krishna Annam

Robert Youdale

Rasta A Mansour

Anthony Glynn

Collin Berman

Methods, systems, and apparatuses are described herein for protecting sensitive data even when Transport Layer Security (TLS) communication sessions are compromised. A computing device may send, via a web browser plugin of a web browser application executing on the computing device and to one or more remote servers, a request for a server secret that comprises a device fingerprint, an identification of the web browser application, and an identification of the web browser plugin. The computing device may receive the server secret and a public certificate associated with the remote server. The computing device may establish, via the web browser application, a TLS session with the one or more remote servers. The computing device may generate a session key. The computing device may receive data comprising unencrypted data and encrypted data. The computing device may decrypt the encrypted data based on the session key.

Secondary data encryption via browser extension

An Internet-connected device, such as a car, refrigerator, or even a laptop can use a second device, such as a cell phone, to support cryptographic operations and communication with token service providers or other processing services requiring pre-provisioned capabilities that may include cryptographic secrets. By removing the need to store personally sensitive data in 'Internet of Things' (IoT) devices, a user's personal information and other sensitive financial information may be contained to a relatively small number of devices. This may help prevent theft of goods or services by IoT devices that are not always under the close control of the user.

Network configuration and management

Embodiments can provide methods for securely provisioning sensitive credential data, such as a limited use key (LUK) onto a user device. In some embodiments, the credential data can be encrypted using a separate storage protection key and decrypted only at the time of a transaction to generate a cryptogram for the transaction. Thus, end-to-end protection can be provided during the transit and storage of the credential data, limiting the exposure of the credential data only when the credential data is required, thereby reducing the risk of compromise of the credential data.

Methods for secure credential provisioning

Embodiments of the invention are directed to methods and systems for software module binding. Cryptographic keys and challenge elements can be exchanged between a first software module and a second software module to create a binding between the first software module and the second software module. As a result, a first software module can securely and authentically access sensitive data and functionality at a second software module, while unauthorized software modules can be prevented from accessing the sensitive data and functionality.

System and method for software module binding

A portable communication device may include a mobile application executing in an application execution environment and a secure application executing in a trusted execution environment. The secure application may receive, from the mobile application, a storage request to store sensitive data. The storage request may include an encrypted data type identifier and an encrypted sensitive data. The secure application may decrypt the encrypted data type identifier and the encrypted sensitive data using a transport key, and re-encrypt the sensitive data using a storage key. The re-encrypted sensitive data can then be stored in a memory of the portable communication device which is outside the trusted execution environment.

Hybrid integration of software development kit with secure execution environment

Techniques for establishing mutual authentication of software layers of an application are described. During initialization of the application, the software layers execute a binding algorithm to exchange secrets to bind the software layers to one another. During subsequent runtime of the software application, the software layers execute a runtime key derivation algorithm to combine the secrets shared during initialization with dynamic time information to generate a data encryption key. The software layers can then securely transfer data with each other by encrypting and decrypting data exchanged between the software layers using the dynamically generated data encryption key.

Mutual authentication of software layers

In certificate chain validation, a parent certificate is used to validate a child certificate. The child certificate can indicate which parent certificate can be used to validate it. In some situations, a child certificate may not contain a certificate authority identifier that can be used to identify the parent certificate. Instead, the child certificate can contain a hash value of a modulus of the parent public key that can be used to identify the parent certificate. The hash value of the modulus of the parent public key can be associated with the parent public key. As such, the parent public key used in certificate chain validation of the child certificate can be identified using the hash value of the modulus of the parent public key.

Systems and methods for certificate chain validation of secure elements

Systems and methods are provided for confidential communication management. For example, a client computer can determine a client key pair comprising a client private key and a client public key. The client computer can further determine a protected server key identifier, identify a server public key associated with the protected server key identifier, and generating a shared secret using the server public key and the client private key. The client computer can further encrypt message data using the shared secret and sending, to a server computer, a message including the encrypted message data, the protected server key identifier, and the client public key. The protected server key identifier can be associated with the server computer and can be usable by the server computer to identify a server private key to be used in decrypting the encrypted message data.

Growing community of inventors

Union City, CA, United States of America

Soumendra Bhattacharya