Capital One Services, LLC

Srinivasa Chigurupati

Kevin Grant Osborn

Jeffrey Rule

James M Ashfield

William Duane

Colin Hart

Paul Y Moreton

Kaitlin J Newman

Daniel Herrington

Wayne David Lutz

Lara Mossler

Ian Prince

James Zarakas

Mark C Dupuis

Systems and methods for integrating a physical safe with one or more hardware security modules ('HSMs') on a server rack may include a server rack with a biometric locking front door, one or more HSMs mounted and physically locked to the server rack, and a rack-mounted safe. The safe may be configured to fit entirely within the server rack when the server rack front door is closed, include a biometric lock on the front door that only unlocks upon a biometric authentication from each of a key custodian A and a key custodian B, and include at least two internal compartments, each secured by a biometric lock, containing physical keys for the locks of the one or more HSMs.

Systems and methods for hardware security module and physical safe integration

Systems and methods, as described herein, relate to increasing the functionality and security of digital wallets. These methods, techniques, and infrastructure may use hardware security modules (HSMs) to manage a plurality of cryptocurrency wallets in a custodial capacity. The HSMs may have functionality incorporated therein improve the functionality and security of cryptocurrency wallets. The aspects discussed herein may also relate to methods, techniques, and infrastructure to securely manage signing keys and cryptocurrency addresses contained in cryptocurrency wallets for a plurality of accounts that may be associated with a user account or user account identifier without exposing the keys to being stolen or otherwise comprised.

Custodial digital wallet management systems

Disclosed herein are system, method, and computer program product embodiments for signing a document by generating a hash value using a smart card. The smart card can receive from a computing device a first hash value generated for the document based on a first hash function, determine a private key based on a private key information stored on the smart card, sign the first hash value by generating a second hash value based on the first hash value using a second hash function and the private key. The second hash value is to authenticate that the second hash value is generated by the smart card based on the first hash value and the private key. The smart card can further assemble a signature package including the second hash value, and transmit the signature package to the computing device.

Secure smart card signing digital documents and validation

Example embodiments of systems and methods for data transmission in a contactless card are provided. The contactless card may include a processor, and a memory. The memory may contain a first applet, a second applet, and a plurality of keys. The first applet and the second applet may be stored within a shared security domain. The second applet may be configured to communicate with the first applet to perform one or more cryptographic services. The second applet may be configured to transmit one or more requests to the first applet to encode one or more payload strings based on the plurality of keys to perform the one or more cryptographic services. The first applet may be configured to perform the one or more cryptographic services on behalf of the second applet based on the one or more requests.

Systems and methods for cryptographic authentication of contactless cards

A dual-factor PIN based authentication system and method uses a cryptogram provided by a contactless card associated with the client in association with a PIN stored by the contactless card to authenticate the client. In some embodiments, cryptogram authentication may be preconditioned upon a PIN match determination by the contactless card. In other embodiments, the cryptogram may be formed at least in part using the personal identification number (PIN) stored on the contactless card encoded using a dynamic key stored by the contactless card and uniquely associated with the client. Authentication may be achieved by comparing the cryptogram formed using the PIN against an expected cryptogram generated an expected PIN and an expected dynamic key.

Contactless card personal identification system

In a method of facilitating encrypted communications between a transmitting system having a unique identifier and a receiving system, a key generation system generates at least one encryption master key for use with the unique identifier and an encryption algorithm to produce a transmitting system-unique encryption key. The key generation system also generates a shared secret master key for use with the unique identifier and a second encryption algorithm to produce a shared secret value. The at least one encryption master key and the shared secret master key are then stored in an encryption information database. The key generation system transmits the at least one encryption master key and shared secret information to the transmitting system and transmits the at least one encryption master key, the shared secret master key and the unique identifier to the receiving data processing system.

Parallel secret salt generation and authentication for encrypted communication

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key. Example embodiments of systems and methods can be used to provide further authentication and added levels of security for transactions.

Systems and methods for cryptographic authentication of contactless cards using risk factors

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key.

A contactless card can include a plurality of keys for a specific operation, e.g., encryption or signing a communication. The contactless card can also include an applet which uses a key selection module. The key selection module can select one of the plurality of keys and the applet can use the key to, e.g., encrypt or sign a communication using an encryption or signature algorithm. The contactless card can send the encrypted or signed communication to a host computer through a client device. The host computer can repeat the key selection technique of the contactless device to select the same key and thereby decrypt or verify the communication.

Contactless card with multiple rotating security keys

Various embodiments are generally directed to utilizing a steganographically encoded image with an offline and/or online verification or authentication protocol. A method for using the steganographic image can include: receiving or utilizing a steganographic image associated with a user at a third-party device, the steganographically encoded image including an identification of a user steganographically encoded with a fingerprint template of the user, and authenticating the user using the steganographically encoded image.

Steganographic image encoding of biometric template information on a card

Example embodiments provide systems and methods for increasing the cryptographic strength of an encryption or message-authentication-code-(MAC) generation technique. According to some embodiments, a MAC may be constructed around a shared secret (such as a random initialization number), thereby increasing strength of the MAC against brute force attacks based on the size of the shared secret. The MAC may be combined with randomized data, and may also be encrypted to further bolster the strength of the code. These elements (shared secret, MAC algorithm, and encryption algorithm) may be employed in various combinations and to varying degrees, depending on the application and desired level of security. At each stage, the cryptographic construct operates on the cyptographically modified data from the previous stage. This layering of cryptographic constructs may increase the strength of the group of contrasts more efficiently than applying any one construct with a larger key size or similar increase in complexity.

Systems and methods for amplifying the strength of cryptographic algorithms

Various embodiments are generally directed to utilizing an offline and/or online verification or authentication protocol to access, redeem, or otherwise utilize multiple loyalty points and loyalty accounts A method for utilizing various loyalty points includes: receiving, by an application executing on a processor, a request to redeem at least one loyalty point of a plurality of loyalty points of a loyalty points account, receiving, by the application, a cryptogram from a contactless card associated with an account, transmitting, by the application to a server, the cryptogram, determining, by the application based on a decryption result received from the server, that the server decrypted the cryptogram, and authorizing, by the application based on the determination that the server decrypted the cryptogram, the request to redeem the at least one loyalty point.

Accessing and utilizing multiple loyalty point accounts

Example embodiments of systems and methods for data transmission system between transmitting and receiving devices are provided. In an embodiment, each of the transmitting and receiving devices can contain a master key. The transmitting device can generate a diversified key using the master key, protect a counter value and encrypt data prior to transmitting to the receiving device, which can generate the diversified key based on the master key and can decrypt the data and validate the protected counter value using the diversified key. In an embodiment, the transmitting device can signal an attack or potential attack through the counter value. The attack signaling can further include information relating to the attack or potential attack.

Systems and methods for signaling an attack on contactless cards

Example embodiments of systems and methods for contactless card verification include a contactless card including a substrate, a processor, and a memory, wherein the memory contains a first applet and a second applet, and a recipient device in data communication with the contactless card, wherein the second applet is configured to retrieve one or more parameters from the first applet via an interface; and wherein the second applet is configured to transmit the one or more parameters to the recipient device for verification.

Growing community of inventors

Long Grove, IL, United States of America

Srinivasa Chigurupati