Facilitating secure transactions using a contactless interface

A device may perform a first authentication operation, associated with a contactless media device, using a first key. The first key may permit a security mode of the contactless media device to be modified. The device may cause the contactless media device to set the security mode to a first security mode that causes the contactless media device to secure at least one transmission from the contactless media device. The device may perform a second authentication operation, associated with the contactless media device, using a second key that permits information to be read from or written to the contactless media device. The device may read first secured information from or write second secured information to the contactless media device. The first secured information or the second secured information may be secured based on the security mode of the contactless media device being set to the first security mode.

BACKGROUND

A contactless media device may refer to a device with embedded integrated circuits that can process and store data, and that can communicate with a terminal (e.g., via radio waves). For example, a contactless media device may include a contactless smart card, a contactless fare card, a near field communications (NFC) device, or the like. A contactless media device may include a re-writeable microchip that can be read from and/or written to using radio waves.

SUMMARY

According to some possible implementations, a device or apparatus may include one or more processors to perform a first authentication operation, associated with a contactless media device, using a security mode key. The one or more processors may provide an instruction to cause the contactless media device to set a security mode to a first security mode based on performing the first authentication operation. The one or more processors may perform a second authentication operation, associated with the contactless media device, using a transaction key. The transaction key may be different from the security mode key. The one or more processors may read first secured information from or write second secured information to the contactless media device based on performing the second authentication operation. The first secured information or the second secured information may be secured based on the security mode of the contactless media device being set to the first security mode. The one or more processors may validate that the first secured information has been read from the contactless media device or that the second secured information has been written to the contactless media device. The one or more processors may provide an instruction to cause the contactless media device to set the security mode to a second security mode based on the validating.

According to some possible implementations, a computer-readable medium may store one or more instructions that, when executed by a processor, cause the processor to perform a first authentication operation, associated with a contactless media device, using a first key. The first key may permit a security mode of the contactless media device to be modified. The one or more instructions may cause the processor to provide an instruction to cause the contactless media device to set the security mode to a first security mode based on performing the first authentication operation. The first security mode may cause the contactless media device to secure at least one transmission from the contactless media device. The one or more instructions may cause the processor to perform a second authentication operation, associated with the contactless media device, using a second key. The second key may permit information to be read from or written to the contactless media device. The one or more instructions may cause the processor to read first secured information from or write second secured information to the contactless media device based on performing the second authentication operation. The first secured information or the second secured information may be secured based on the security mode of the contactless media device being set to the first security mode.

According to some possible implementations, a method may include performing, by a first device, a first authentication operation, associated with a contactless media device, using a first key. The first key may permit a security mode of the contactless media device to be modified. The method may include providing, by the first device, an instruction to cause the contactless media device to set the security mode to a first security mode based on performing the first authentication operation. The first security mode may cause the contactless media device to secure at least one transmission from the contactless media device. The method may include performing, by the first device, a second authentication operation, associated with the contactless media device, using a second key. The second key may permit the first device to read from or write to the contactless media device. The method may include reading or writing, by the first device, secured information from or to the contactless media device based on performing the second authentication operation. The secured information may be secured based on the security mode of the contactless media device being set to the first security mode.

DETAILED DESCRIPTION

A contactless media device (e.g., a contactless smart card, a contactless fare card, a contactless security card, a mobile wallet, a secure element based mobile wallet, etc.) may be capable of communicating in different security modes, such as a high security mode and a low security mode. In the high security mode, communications to and/or from the contactless media device may be encrypted, encoded, or the like. In the low security mode, communications to and/or from the contactless media device may be unencrypted, unencoded, or the like (e.g., may be in plaintext). When a transaction system operator controls an interface device (e.g., a fare card terminal, a fare card kiosk, etc.) that communicates with the contactless media device, the devices may authenticate one another in a high security mode, and then may communicate using a low security mode.

However, some interface devices are not controlled by a system operator, and are less secure. For example, a mobile device (e.g., a smart phone) may be capable of communicating with the contactless media device (e.g., via a near-field communication (NFC) interface). A user of an interface device may want to be able to use the interface device to communicate with the contactless media device. This may introduce increased security risks that subject the contactless media device, or a transaction system associated with the contactless media device, vulnerable to attacks, such as relay attacks or man-in-the-middle attacks (e.g., if the interface device is lost or stolen, if a third party device is used to intercept communications with the interface device and/or the contactless media device, etc.). Implementations described herein facilitate secure communications between contactless media devices and interface devices.

FIG. 1is a diagram of an overview of an example implementation100described herein. As shown inFIG. 1, an interface device, such as a smart phone, may execute a mobile contactless media application that permits a user to transact with a contactless media device, such as a fare card. For example, the interface device may include an NFC interface that permits the interface device to communicate with the contactless media device, such as when the user brings the contactless media device within communicative proximity of the interface device (e.g., by tapping the fare card on the smart phone). As shown, the user may interact with the interface device to identify a transaction to be performed in association with the contactless media device.

The interface device may act as an interface between the contactless media device and a remote device used to read information from and/or write information to the contactless media device. As shown, the contactless media device and the remote device may communicate, via the interface device, to authenticate one another using a security mode key. After successful authentication, the remote device (or the interface device, in some implementations) may set the contactless media device to a high security mode. While in the high security mode communications between the contactless media device and the remote device may be secured via encryption, encoding, or the like.

As further shown, the contactless media device and the remote device may further authenticate one another using a transaction key. After successful authentication, the remote device, via the interface device, may read information from and/or write information to the contactless media device. For example, when the contactless media device is a fare card or a similar device, the remote device may read a card balance, may update a card balance, may add, remove, or modify a transit pass associated with the fare card, may modify a user profile associated with the fare card, may read a transaction history associated with the fare card, or the like. The remote device may provide information read from the contactless media device to the interface device for display, or may write information to the contactless media device based on input received from the interface device.

The above transactions may take place using secure communications (e.g., in the high security mode). When the transactions have been completed, the contactless media device and the remote device may again communicate, via the interface device, to authenticate one another using the security mode key. After successful authentication, the remote device (or the interface device, in some implementations) may set the contactless media device to a low security mode to permit communication with other devices. In this way, communications between contactless media devices and interface devices may be made more secure.

FIG. 2is a diagram of an example environment200in which systems and/or methods, described herein, may be implemented. As shown inFIG. 2, environment200may include a contactless media device210, an interface device220, a remote device230, and a network240. Devices of environment200may interconnect via wired connections, wireless connections, or a combination of wired and wireless connections.

Contactless media device210may include one or more devices capable of receiving, storing, and/or providing card information associated with a contactless media system, and/or capable of communicating card information using multiple security modes. For example, contactless media device210may include a smart card (e.g., a contactless smart card, a reloadable smart card, a reprogrammable smart card, etc.), a chip card, an integrated circuit card, an identification card, a proximity card, an access card, a contactless card, a radio-frequency identification (RFID) card, a limited use media, a mobile device (e.g., a mobile device executing a fare card application, such as a mobile wallet; a mobile device with data stored in secure element storage; etc.), a memory card (e.g., a nonvolatile memory card, a secure digital card, a subscriber identity module (SIM) card with secure element storage, a micro SD card with secure element storage, etc.), a sensor, a near-field communication (NFC) device (e.g., an NFC tag, a Bluetooth tag, a Bluetooth low energy tag, a Bluetooth 4.0 device, a sensor sticker, etc.), a wearable device, a wireless key fob, or the like. As another example, contactless media device210may include a MiFARE contactless card, such as MiFARE Desfire, MiFARE Desfire EV1, and MiFARE Desfire EV2, or the like.

Contactless media device210may store card information, such as a card balance stored by contactless media device210or a credential stored by contactless media device210(e.g., a credential used to access a card balance via a back office server device). Interface device220and/or remote device230may interact with contactless media device210to read and/or write the card information stored by contactless media device210. Contactless media device210may be capable of communicating using multiple security modes, such as a high security mode (e.g., an encrypted mode, a symmetrically encrypted mode, an asymmetrically encrypted mode, an encoded mode, a ciphertext mode, etc.) and a low security mode (e.g., an unencrypted mode, an unencoded mode, a plaintext mode, etc.). Contactless media device210may communicate information with other devices by applying different security protocols (e.g., encryption, symmetric encryption, asymmetric encryption, encoding, message authentication coding (MAC), etc.) based on the security mode.

Interface device220may include one or more devices capable of reading card information from contactless media device210and/or writing card information to contactless media device210. For example, interface device220may include a mobile phone (e.g., a smart phone), a tablet computer, a handheld inspection device, a contactless smart card reader, a fare card terminal, a fare card vending machine, a fare box, a ticket machine, a station device (e.g., that interacts with a turnstile or a fare gate), a turnstile, a fare gate, a card reader, a card writer, a card query device (e.g., used to check a card balance), a kiosk (e.g., a self-service kiosk), an inspection device (e.g., used to check whether a passenger paid a fare), a point-of-sale device, a fare transaction processor, a wearable device, a smart watch, or the like. Interface device220may be configured to read card information from and/or write card information to contactless media device210in communicative proximity (e.g., within a particular range, such as a few centimeters, ten meters, etc.) of interface device220.

Interface device220may include a contactless interface (e.g., an NFC interface, an RFID interface, etc.) for communicating with contactless media device210. Additionally, or alternatively, contactless media device210may be housed within interface device220, such as when contactless media device210is a memory card, an NFC device, or the like. In some implementations, interface device220may include secure key storage memory, which may store one or more authentication keys (e.g., a security mode key, a transaction key, etc.) in a secure memory location. In some implementations, an authentication key may be generated from a master key associated with a particular contactless media device210(e.g., based on a device identifier, serial number, memory signature, etc. associated with contactless media device210). In this way, a transaction system may not be compromised if an attacker learns the authentication key, as the authentication key may only work with the particular contactless media device210with which the authentication key is associated.

Remote device230may include one or more devices capable of receiving, generating, storing, process, and/or providing card information associated with contactless media device210. For example, remote device230may include a computing device, such as a server (e.g., an application server, a transaction server, an authentication server, etc.), a desktop computer, a laptop computer, or the like. Remote device230may communicate with contactless media device210via interface device220. In some implementations, remote device230may include secure key storage memory, which may store one or more authentication keys (e.g., a security mode key, a transaction key, etc.) in a secure memory location. Additionally, or alternatively, remote device230may be located in a cloud-based environment.

Network240may include one or more wired and/or wireless networks. For example, network240may include a cellular network, a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., the Public Switched Telephone Network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, and/or a combination of these or another type of network.

FIG. 3is a diagram of example components of a device300. Device300may correspond to contactless media device210, interface device220, and/or remote device230. In some implementations, contactless media device210, interface device220, and/or remote device230may include one or more devices300and/or one or more components of device300. As shown inFIG. 3, device300may include a bus310, a processor320, a memory330, a storage component340, an input component350, an output component360, and a communication interface370.

Storage component340may store information and/or software related to the operation and use of device300. For example, storage component340may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, etc.), a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a cartridge, a magnetic tape, and/or another type of computer-readable medium, along with a corresponding drive. In some implementations, storage component340may include secure key storage memory to store one or more authentication keys in a secure memory location

Communication interface370may include a transceiver-like component (e.g., a transceiver, a separate receiver and transmitter, etc.) that enables device300to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface370may permit device300to receive information from another device and/or provide information to another device. For example, communication interface370may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, an NFC interface (e.g., a Bluetooth interface, a Bluetooth low energy interface, etc.), an ultrasonic interface, a Wi-Fi interface, a cellular network interface, or the like. In some implementations, communication interface370may include a contactless interface for wireless communication with another device.

Device300may perform one or more processes described herein. Device300may perform these processes in response to processor320executing software instructions stored by a computer-readable medium, such as memory330and/or storage component340. A computer-readable medium is defined herein as a non-transitory memory device. In some implementations, the computer-readable medium may include a computer program product. A memory device includes memory space within a single physical storage device or memory space spread across multiple physical storage devices.

FIG. 4is a flow chart of an example process400for facilitating secure transactions using a contactless interface. In some implementations, one or more process blocks ofFIG. 4may be performed by remote device230. In some implementations, one or more process blocks ofFIG. 4may be performed by another device or a group of devices separate from or including remote device230, such as contactless media device210and/or interface device220.

As shown inFIG. 4, process400may include receiving a request to read information from and/or write information to a contactless media device (block410). For example, remote device230may receive a request to read card information from and/or write card information to contactless media device210. In some implementations, remote device230may receive the request from interface device220. For example, a user may interact with interface device220(e.g., via a contactless media application executing on interface device220) to provide input that causes the request to be sent to remote device230.

In some implementations, the request may be associated with a fare system. For example, contactless media device210may include a fare card or a similar device, and the request may include a request to view a card balance stored by the fare card, to modify the card balance stored by the fare card (e.g., by adding, removing, or modifying funds associated with the fare card), to modify transit pass information stored by the fare card (e.g., by adding, removing, or changing a transit pass), to modify user profile information stored by the fare card (e.g., by adding, removing, or changing user profile information), to view a transaction history associated with the fare card, or the like.

Additionally, or alternatively, the request may be associated with an access system. For example, contactless media device210may include an access card or a similar device, and the request may include a request to modify access permissions (e.g., by adding, removing, or changing access permissions), to modify user profile information stored by the access card (e.g., by adding, removing, or changing user profile information), or the like.

In some implementations, the request may identify contactless media device210associated with the request. For example, the user may bring contactless media device210within communicative proximity of interface device220(e.g., by tapping contactless media device210on or near interface device220, by bringing contactless media device210within an NFC range of interface device220, etc.), and interface device220may determine a device identifier that identifies contactless media device210(e.g., a card number, an account number, a serial number, etc.). Interface device220may provide the device identifier to remote device230. In some implementations, the user may not need to bring contactless media device210within communicative proximity of interface device220because interface220emulates contactless media device210. In this case, interface device220may store card information described elsewhere herein as being stored by contactless media device210.

As further shown inFIG. 4, process400may include performing an authentication operation, associated with the contactless media device, using a security mode key (block420). For example, remote device230and contactless media device210may communicate, via interface device220, to perform an authentication operation. Additionally, or alternatively, interface device220and contactless media device210may communicate to perform the authentication operation (without remote device230). The authentication operation may be performed to authenticate the devices to one another before changing a security mode of contactless media device210. For example, the authentication operation may be performed using an authentication protocol, such as key authentication, challenge-response authentication, or the like.

In some implementations, remote device230(and/or interface device220) and contactless media device210may exchange one or more security mode keys to authenticate one another. For example, the authentication operation may include an exchange of symmetric cryptographic keys, an exchange of asymmetric keys (e.g., via public-key cryptography, where each device uses a private key to decrypt the public key), or the like.

In some implementations, the authentication operation may include remote device230sending a request to authenticate to contactless media device210using a particular dedicated key (e.g., identified by a key number, a string of characters, etc.). The dedicated key may be unique to a particular contactless media device210, in some implementations. Remote device230may receive, from contactless media device210, a first random value (RNDA) encrypted using the dedicated key. Remote device230may decrypt the encrypted first random value using, for example, a shared key or a private key. In some implementations, remote device230may use the same dedicated key as contactless media device210, and may determine the dedicated key by performing a mathematical operation on a device identifier and/or a master key associated with contactless media device210.

In some implementations, remote device230may perform a mathematical operation (e.g., a bit shifting operation) on the first random value to obtain a changed first random value (RNDA′). Remote device230may combine (e.g., by appending, concatenating, combining mathematically, etc.) the changed first random value (RNDA′) and a second random value (RNDB), generated by remote device230, to form a third random value (e.g., RNDA′+RNDB). Remote device230may encrypt the third random value, and may transmit the third random value to contactless media device210(e.g., via interface device220). Contactless media device210may decrypt the third random value (e.g., using a key) to verify whether remote device230has successfully decrypted the first random value, thus authenticating remote device230to contactless media device210. For example, contactless media device210may separate the third random value into the changed first random value (RNDA′) and the second random value (RNDB) (e.g., by performing a reverse mathematical operation of the mathematical operation performed by remote device230to generate the third random value). Contactless media device210may perform a reverse mathematical operation as remote device230to convert the changed first random value (RNDA′) to the first random value (RNDA) to verify whether this first random value matches the first random value originally sent by contactless media device210to remote device230.

Additionally, or alternatively, contactless media device210may perform a mathematical operation on the second random value (RNDB), received from remote device230, to generate a modified second random value (RNDB′). Contactless media device210may encrypt the modified second random value, using the security mode key, and may transmit the encrypted and modified second random value to remote device230(e.g., via local device210). Remote device230may decrypt the modified second random value to verify whether contactless media device210has successfully decrypted the second random value, thus authenticating contactless media device210to remote device230. In some implementations, contactless media device210and remote device230may use the first random value, the second random value, a value determined by performing a mathematical operation using the first random value and/or the second random value, or the like, as a session key for a communication session between the devices (e.g., a communication session for setting a security mode of contactless media device210). In some implementations, a new session key may be used for each communication session.

In some implementations, a separate authentication may be performed for different operations associated with an application (e.g., a fare card application, an access card application, etc.) stored by contactless media device210, including reading information associated with an application, changing one or more keys of an application (e.g., an application stored by contactless media device210, a storage sector or block of contactless media device210, all or a portion of information stored by contactless media device210, etc.), creating and deleting files within the application, changing access rights for an application, accessing data files of the application, or the like. Additionally, or alternatively, separate authentication operations may be performed for different applications. The authentication operation may also be performed before gathering information about the applications stored on contactless media device210, before changing dedicated keys assigned to contactless media device210, changing settings associated with contactless media device210, creating or deleting applications, or the like. In some implementations, authentication states can be invalidated by changing the key that was used for reaching the currently valid authentication state, or a failed subsequent authentication.

In some implementations, communication between contactless media device210and interface device220, between contactless media device210and remote device230, and/or between interface device220and remote device230may be encrypted using different keys (e.g., different session keys). For example, interface device220may separately authenticate to and establish secure communication with remote device230before secure communication between remote device230and contactless media device210is permitted. In some implementations, authentication with a particular key (e.g., a security mode key) may permit remote device230to change a security mode of contactless media device210. If authentication fails, remote device230may not be permitted to change the security mode.

As further shown inFIG. 4, process400may include setting the contactless media device to a first security mode based on performing the authentication operation using the security mode key (block430). For example, remote device230may send an instruction to contactless media device210to set a security mode of contactless media device210. The security mode may control a manner in which transmissions from contactless media device210are secured. For example, the security mode may include a high security mode, where contactless media device210encrypts (e.g., symmetrically, asymmetrically, etc.), encodes (e.g., using message authentication code), etc., transmissions. As another example, the security mode may include a low security mode, where contactless media device210does not encrypt, encode, etc., transmissions. Additionally, or alternatively, the security mode may include one or a combination of encryption types, encoding types, or the like. In some implementations, there may be additional security modes (e.g., a medium security mode that is less secure than the high security mode and more secure than the low security mode).

Additionally, or alternatively, based on an instruction from remote device230, contactless media device210may set a security mode for one or more applications of contactless media device210(e.g., an access card application, a transit card application, etc.), for one or more files stored by contactless media device210, for different access permissions (e.g., read access to information stored by contactless media device210, write access, read and write access, etc.), or the like. By setting the security mode to high security, remote device230may prevent interface device220and/or another device (e.g., a third party attacker device) from intercepting and/or decrypting communications between contactless media device210and remote device230.

In some implementations, a secure channel may be used for communications with contactless media device210. In this case, communications with contactless media device210may be transmitted via the secure channel (e.g., to and/or from interface device220and/or remote device230) when contactless media device210is in the high security mode. In some implementations, an unsecure channel may be used when contactless media device210is in a low security mode, described elsewhere herein. Additionally, or alternatively, the unsecure channel may be used when a connection via the secure channel times out.

As further shown inFIG. 4, process400may include performing an authentication operation, associated with the contactless media device, using a transaction key (block440). For example, remote device230and contactless media device210may perform an authentication operation, as described elsewhere herein. The authentication operation using the transaction key may be performed in a similar manner as the authentication operation using the security mode key, described above in connection with block420. Authentication using the security mode key may permit remote device230to modify a security mode of contactless media device210, while authentication using the transaction key may permit remote device230to perform a transaction associated with contactless media device210. A transaction may refer to reading information from and/or writing information to contactless media device210.

In some implementations, the security mode key and the transaction key may be different keys. Alternatively, the security mode key and the transaction key may be the same key (e.g., a single key may be used to change a security mode of contactless media device210and permit a transaction with contactless media device210). In some implementations, different transactions may be authenticated using different transaction keys. For example, remote device230and contactless media device210may authenticate one another using a first transaction key when remote device230intends to read information from contactless media device210, may authenticate one another using a second transaction key when remote device230intends to write information to contactless media device210, may authenticate one another using a third transaction key (or both the first and second transaction keys) when remote device230intends to read information from and write information to contactless media device210, or the like.

In some implementations, the transaction key may include different keys for different types of transactions. For example, the transaction key may include a read key when information is being read from contactless media device210. As another example, the transaction key may include a write key when information is being written to contactless media device210. As another example, the transaction key may include a read/write key when information is being read from and written to contactless media device210. Two or more of the read key, the write key, and the read/write key may includes a same key or different keys.

As further shown inFIG. 4, process400may include reading information from and/or writing information to the contactless media device based on performing the authentication operation using the transaction key (block450). For example, remote device230may provide an instruction to contactless media device210requesting information stored by contactless media device210, and/or requesting that information be written to contactless media device210.

As an example, remote device230may read a card balance from contactless media device210, may modify a card balance stored by contactless media device210(e.g., may add funds to the card balance), may read a transit pass stored by contactless media device210, may modify a transit pass stored by contactless media device210, may change profile information stored by contactless media device210, may read a transaction history stored by contactless media device210, may modify a transaction history stored by contactless media device210, may read access rights stored by contactless media device210, may modify access rights stored by contactless media device210, or the like. In some implementations, reading information from contactless media device210may be performed by interface device210, and writing information to contactless media device210may be performed by remote device230.

As further shown inFIG. 4, process400may include validating that the information was read from and/or written to the contactless media device (block460). For example, remote device230may verify whether information was successfully read from contactless media device210by comparing the information to stored information, by determining whether the information matches a particular format (e.g., a number, a dollar amount, etc.), or the like. In some implementations, remote device230may verify whether information was successfully written to contactless media device210by requesting that the information be written to contactless media device210, reading the written information from contactless media device210, and verifying that the information to be written and the read information match.

As further shown inFIG. 4, process400may include performing an authentication operation, associated with the contactless media device, using the security mode key (block470), and setting the contactless media device to a second security mode based on performing the authentication operation using the security mode key (block480). For example, remote device230and contactless media device210may authenticate one another using a security mode key, as described herein in connection with block420. Based on the authentication, remote device230may instruct contactless media device210to set a security mode to a different security mode, such as a low security mode (e.g., where transmissions are not encrypted). In this way, remote device230may set contactless media device210to a high security mode for more sensitive transactions, and may set contactless media device210to a low security mode for less sensitive transactions.

In some implementations, the security mode key used to authenticate before setting contactless media device210to the high security mode and the security mode key used to authenticate before setting contactless media device210to the low security mode may be the same security key. Alternatively, these security mode keys may be different security mode keys.

FIG. 5is a diagram of an example call flow500relating to example process400shown inFIG. 4.FIG. 5shows an example where remote device230authenticates and transacts with contactless media device210via interface device220.

As shown inFIG. 5, call flow500may include authenticating using a security mode key (reference number505). For example, remote device230may authenticate contactless media device210by communicating with contactless media device210over a contactless interface of interface device220. Remote device230and contactless media device210may authenticate one another using a security mode key stored in secure key storage of remote device230. The security mode key may permit remote device230to change a security mode of the contactless media device210to a high security mode, such as a symmetrically encrypted mode, an asymmetrically encrypted mode, a message authentication coded (MAC) mode, etc. In some implementations, the authentication may involve multiple steps, and may establish the identity of both contactless media device210to remote device230and remote device230to contactless media device210.

As further shown inFIG. 5, call flow500may include setting a security mode of contactless media device210to a high security mode (reference number510). For example, following authentication of remote device230and contactless media device210, remote device230may instruct contactless media device210to enter a high security mode of communication. In some implementations, instructions sent from remote device230to contactless media device210may be transmitted in a high security mode (e.g., encrypted, encoded, etc.), and may be sent to contactless media device210via interface device220(e.g., via a contactless interface). Additionally, or alternatively, the instructions may be padded, may be transmitted with an error detection code and/or an error-correcting code (e.g., a checksum, a cyclic redundancy check, etc.). When such codes are used, an intruding device or application may be prevented from manipulating the instructions. Additionally, or alternatively, remote device230may transmit a commit command to contactless media device210to commit any changes.

As further shown inFIG. 5, call flow500may include authenticating using a read key (reference number515), reading secured information (reference number520), and validating the information (reference number525). For example, remote device230and contactless media device210may authenticate one another using a read key (e.g., stored in secure key storage of remote device230). The authentication may involve multiple steps, and may establish the identity of contactless media device210to remote device230and remote device230to contactless media device210. Following authentication, remote device230may request information to be read from contactless media device210. Contactless media device210may secure the information (e.g., using encryption, etc., and based on being in the high security mode), and may send the secured information to remote device230(e.g., via interface device220). Remote device230may determine if the information has been properly secured (e.g., encrypted, encoded, etc.), and may verify that contactless media device210is properly operating in the high security mode. Remote device230may use the read information, as described in more detail elsewhere herein. Additionally, or alternatively, remote device230may transmit a commit command to contactless media device210to commit any changes.

As further shown inFIG. 5, call flow500may include authenticating using a write or read/write key (reference number530), writing secured information to contactless media device210(reference number535), reading the secured information back from contactless media device210(reference number540), and validating the information (reference number545). For example, remote device230and contactless media device210may authenticate one another. Authentication may be accomplished using a write key and/or a read/write key. Following authentication, remote device230may send secured information and a write instruction to interface device220, which may provide the instruction and/or the secured information to be written to contactless media device210. Following receipt of the secured information, contactless media device210may or may not decrypt or decode the secured information before storing the secured information, depending on the requirements of a particular application associated with the secured information.

The written information may be read back by remote device230from contactless media device210for verification. For example, remote device230may decrypt, decode, etc. the information, and may validate that the information has been properly written to contactless media device210. In some implementation, interface device210may receive the secured information from contactless media device210, and may generate a hash (e.g., a one-way hash, etc.) of the secured information. Remote device230may compare the hash to another hash generated from the secured information transmitted by remote device230(e.g., as sent to interface device220for transmission to contactless media device210). In some implementations, remote device230may transmit a commit command to contactless media device210to commit any changes (e.g., to cause contactless media device210to store the changes to memory until a different command is received).

As further shown inFIG. 5, call flow500may include authenticating using a security mode key (reference number550), setting a security mode of contactless media device210to low security (reference number555), and validating low security operation of contactless media device210(reference number560). For example, remote device230and contactless media device210may authenticate one another using the security mode key. The security mode key may permit remote device230to change a security mode of contactless media device210back to a low security (e.g., plaintext) mode of communication. Following authentication, remote device230may command contactless media device210to enter the low security (e.g., normal) mode of communication. In some implementations, remote device230may securely transmit the command. Additionally, or alternatively, remote device230may validate low security operation of contactless media device210by testing a plaintext read from contactless media device210. In some implementations, remote device230may transmit a commit command to contactless media device210to commit any changes.

As indicated above,FIG. 5is provided merely as an example. Other examples are possible and may differ from what was described with regard toFIG. 5. For example, one or more of the above operations may be repeated until a desired result is obtained (e.g., authentication, reading, writing, validating, setting a security mode, etc.).

FIG. 6is a diagram of another example call flow600relating to example process400shown inFIG. 4.FIG. 6shows an example where interface device220sets a security mode of contactless media device210, and where remote device230reads from and writes to contactless media device210.

As shown inFIG. 6, interface device220may perform one or more operations described with respect toFIG. 5as being performed by remote device230. For example, and as shown by reference numbers605and610, interface device220and contactless media device210may authenticate one another using a security mode key, and interface device220may instruct contactless media device210to modify a security mode from low security to high security.

As shown by reference numbers615-645, remote device230and contactless media device210may authenticate using a read key, a write key, and/or a read/write key, and may perform a transaction based on the authentication (e.g., a read operation, a write operation, etc.). Additionally, or alternatively, remote device230may validate information read from and/or written to contactless media device210. While not shown, interface device220may perform one or more of these operations, in some implementations.

As shown by reference numbers650and655, interface device220and contactless media device210may authenticate one another using a security mode key, and interface device220may instruct contactless media device210to modify a security mode from high security to low security. As shown by reference number660, interface device220may validate that contactless media device210is operating in a low security mode.

As indicated above,FIG. 6is provided merely as an example. Other examples are possible and may differ from what was described with regard toFIG. 6.

FIGS. 7A-7Eare diagrams of an example implementation700relating to example process400shown inFIG. 4.FIGS. 7A-7Eshow an example of facilitating secure transactions using a contactless interface.

As shown inFIG. 7A, and by reference number705, assume that a user interacts with interface device220, shown as a mobile phone. Assume that interface device220executes a mobile fare card application that permits the user to perform transactions associated with a fare card (e.g., a contactless media device210), such as checking a card balance, adding money to the fare card, adding a transit pass to the fare card, changing a user profile stored on the fare card, viewing a transaction history stored on the fare card, or the like. As shown, the user selects to check a card balance. As shown by reference number710, based on the user selection, assume that the mobile fare card application prompts the user to tap the user's fare card on interface device220, to bring the fare card within communicative proximity of interface device220. As shown, assume that the user brings the fare card within communicative proximity of interface device220, such that the devices are able to communicate (e.g., via an NFC communication session).

As shown inFIG. 7B, and by reference number715, the fare card and remote device230authenticate one another by exchanging security mode keys via interface device220. As shown by reference number720, remote device230sends an instruction that causes the fare card to set a security mode to an encrypted mode. Because the devices have authenticated one another, the fare card accepts the instruction and sets the security mode to the encrypted mode.

As shown inFIG. 7C, and by reference number725, the fare card and remote device230authenticate one another by exchanging read keys via interface device220. As shown by reference number730, remote device230reads an encrypted card balance received from the fare card. For example, remote device230may request the encrypted card balance. Because the devices have authenticated one another, the fare card responds to the request by encrypting the card balance (based on being in the encrypted mode) and sending the encrypted card balance to remote device230. As shown by reference number735, remote device230decrypts the card balance.

As shown inFIG. 7D, and by reference number740, remote device230provides the card balance to interface device220. In some implementations, remote device230may separately secure (e.g., encrypt, encoded, etc.) the card balance when sending the card balance to interface device220(e.g., using the same read key, using a different key, etc.). As shown by reference number745, interface device220receives the card balance, and provides the card balance for display to the user. In this way, interface device220may securely provide the card balance with reduced risk that the card balance is intercepted by a third party attacker device.

As shown inFIG. 7E, and by reference number750, the fare card and remote device230again authenticate one another by exchanging the security mode keys via interface device220. As shown by reference number755, remote device230sends an instruction that causes the fare card to set a security mode to an unencrypted mode. Because the devices have authenticated one another, the fare card accepts the instruction and sets the security mode to the unencrypted mode. In some implementations, remote device230may verify that the fare card has been set to the unencrypted mode by reading plaintext information from the fare card. In this way, remote device230may be used to facilitate secure transactions with the fare card via a contactless interface of interface device220. In some implementations, authentication may only be required when changing the security mode from the high security mode to the low security mode, and may not be required when changing from the low security mode to the high security mode.

As indicated above,FIGS. 7A-7Eare provided merely as an example. Other examples are possible and may differ from what was described with regard toFIGS. 7A-7E.

FIGS. 8A-8Fare diagrams of another example implementation800relating to example process400shown inFIG. 4.FIGS. 8A-8Fshow an example of facilitating secure transactions using a contactless interface.

As shown inFIG. 8A, and by reference number805, assume that a user interacts with interface device220, shown as a mobile phone. Assume that interface device220executes a mobile fare card application that permits the user to perform transactions associated with a fare card (e.g., a contactless media device210), such as checking a card balance, adding money to the fare card, adding a transit pass to the fare card, changing a user profile stored on the fare card, viewing a transaction history stored on the fare card, or the like. As shown, the user selects to add money to the fare card. As shown by reference number810, based on the user selection, assume that the mobile fare card application prompts the user to tap the user's fare card on interface device220, to bring the fare card within communicative proximity of interface device220. As shown, assume that the user brings the fare card within communicative proximity of interface device220, such that the devices are able to communicate (e.g., via an NFC communication session).

As shown inFIG. 8B, and by reference number815, the fare card and interface device220authenticate one another by exchanging security mode keys. As shown by reference number820, interface device220sends an instruction that causes the fare card to set a security mode to an encrypted mode. Because the devices have authenticated one another, the fare card accepts the instruction and sets the security mode to the encrypted mode.

As shown inFIG. 8C, and by reference number825, the fare card and remote device230authenticate one another by exchanging read keys via interface device220. As shown by reference number830, remote device230reads an encrypted card balance received from the fare card. For example, remote device230may request the encrypted card balance. Because the devices have authenticated one another, the fare card responds to the request by encrypting the card balance (based on being in the encrypted mode) and sending the encrypted card balance to remote device230. As shown by reference number835, remote device230decrypts the card balance.

As shown inFIG. 8D, and by reference number840, remote device230provides the card balance to interface device220. As shown by reference number845, interface device220receives the card balance, provides the card balance for display to the user, and prompts the user to input an amount of money to add to the fare card. As shown by reference number850, assume that the payment is validated (e.g., by remote device230or another device, such as a payment authentication server), and the amount of the transaction (e.g., $50.00) is provided to remote device230.

As shown inFIG. 8E, and by reference number855, the fare card and remote device230authenticate one another by exchanging write keys via interface device220. As shown by reference number860, remote device230writes an updated card balance to the fare card. For example, remote device230may provide the updated card balance to the fare card, and may provide an instruction to update the card balance stored by the fare card. Because the devices have authenticated one another, the fare card updates the stored card balance.

As shown inFIG. 8F, and by reference number865, the fare card and interface device220again authenticate one another by exchanging the security mode keys. As shown by reference number870, interface device220sends an instruction that causes the fare card to set a security mode to an unencrypted mode. Because the devices have authenticated one another, the fare card accepts the instruction and sets the security mode to the unencrypted mode. In some implementations, interface device220may verify that the fare card has been set to the unencrypted mode by reading plaintext information from the fare card. In this way, interface device220may be used to facilitate secure transactions with the fare card via a contactless interface of interface device220.

As indicated above,FIGS. 8A-8Fare provided merely as an example. Other examples are possible and may differ from what was described with regard toFIGS. 8A-8F.

Implementations described herein facilitate secure communications between contactless media devices and interface devices, and/or between contactless media devices and remote devices.