American Express Travel Related Services Company, Inc.

Ajay Babu Maddukuri

Manish K Deliwala

John G McDonald

Jonathan Ward Lupton

Keshav A Narsipur

Curtis Watson

Naresh Bhandari

Varaprasad Kotha

Andras L Ferenczi

Emery Schoenly

Disclosed are various embodiments for offline decentralized identity-based communications between software applications. In one non-limiting example, a system can include a computing device that is configured to detect a network connection loss to a network and receive, via a local area network, a request for an action to be performed by a client device. The request includes a first digital signature of the client device and is associated with a decentralized identifier. The computing device is configured to generate a mutually signed request that includes a second digital signature executed by the computing device and the first digital signature. The mutually signed request is transmitted to the client device. A network connection to the network is detected. The decentralized identifier is validated using the network. The requested action is performed by the computing device based at least in part on the validation of the decentralized identifier.

Offline decentralized identity-based communication for applications

Disclosed are various embodiments for securely conducting online in-application purchases. In one example, among others, a system comprises a computing device that is configured to identify a purchase request from a merchant application executed on the computing device and authenticate an account with a wallet provider based at least in part on a selection of the account. The computing device is configured to receive an instruction from the wallet provider to execute a security library and determine that the computing device is secure by executing a security library. The execution of the security library generates a device response for the wallet provider. A security code is determined data received from the wallet provider. A token is transmitted for the purchase request to the wallet provider based at least in part on the security code.

Systems and methods for in-application and in-browser purchases

A system, method, and computer readable medium (collectively, the 'system') are provided. The system may include a processor configured to perform operations and/or steps comprising receiving a selection of a transaction account to be used as payment for a transaction; and transmitting a wireless signal carrying emulated track data for payment of the transaction, wherein the emulated track data emulates data in tracks of a magnetic card and includes alias transaction account data in place of actual transaction account data.

Magnetic card swipe emulation systems and methods

Various embodiments for sending a cryptogram to a point of sale terminal while disconnected from a network. In some embodiments, for example, a computing device that is configured to display a prompt for a selection of a transaction account. An encrypted session key is retrieved through a network in response to determining a number of session keys associated with the transaction account is below a threshold. The computing device is also configured to generate a session key based at least in part on decrypting the encrypted session key using an encryption key and establish a wireless connection with a point of sale terminal for a purchase. A cryptogram is generated from the session key based at least in part on the user device being disconnected from the network. The cryptogram is sent to the point of sale terminal.

Sending a cryptogram to a POS while disconnected from a network

Systems, methods, and articles of manufacture for secured account provisioning and payments using user computing devices are provided. One such method comprises obtaining an account payload by the user computing device, wherein the account payload comprises a payment credential associated with a transaction account of a user of the user computing device; generating a storage encryption (ENC) key and a storage message authentication code (MAC) key based on at least a device fingerprint of the user computing device and a storage root key; encrypting, the account payload with the storage ENC key to form an encrypted account payload; generating a digital signature of the encrypted account payload using the storage MAC key; and storing the encrypted account payload and the digital signature in a secured database of the user computing device.

Secured account provisioning and payments for NFC-enabled devices

A system may identify a purchase transaction request from a merchant application and generate an in-app payment cryptogram for the purchase transaction request based on a limited use payment credential (LUPC). The in-app payment cryptogram may be provided to the merchant application. The merchant application may transmit the in-app payment cryptogram to a merchant computing device. A request may be received from a payment network to update the LUPC. A security library may be executed to determine that the client device is secure. The execution of the security library may generate a device attestation response, and the device attestation response is transmitted to the payment network. An updated LUPC may be received from the payment network.

A system, method, and computer readable medium (collectively, the 'system') are provided. The system may include a processor configured to perform operations and/or steps comprising receiving a wireless signal from a transaction device, wherein the wireless signal carries emulated track data for payment of a transaction; reading the emulated track data from the wireless signal; generating a transaction payload, wherein the transaction payload contains transaction account data and a dynamically generated digital signature value from the emulated track data of the wireless signal; transmitting the transaction payload to an authorization network server; receiving an authorization instruction from the authorization network server for handling payment of the transaction; and processing the payment of the transaction in accordance with the authorization instruction.

Transaction device use of a dynamically generated value based on a next expected session key

Systems, methods, and articles of manufacture for secured account provisioning and payments using near-field communication (NFC) enabled devices are provided. The system may receive an encrypted account provisioning request comprising a provisioning account and a device fingerprint; decrypt the encrypted account provisioning request with a server root key; retrieve a limited use payment credential (LUPC) based on the provisioning account; generate an ENC key, a MAC key, and a DEK key based on the device fingerprint and the server root key; and encrypt the LUPC using the ENC key, the MAC key, and the DEK key to generate an encrypted account payload.

A system may receive a request for a payment payload for a payment transaction with the request including a token and a transaction amount. The token may identify a transaction account for use in the payment transaction. The system may assess the risk of fraud associated with the transaction account and the payment transaction. The system may return the payment payload in response to a favorable risk assessment. The payment payload may be passed to a merchant and from the merchant to a payment network for evaluation. The payment transaction may be approved or declined based on the contents of received payment payload matching the contents of a generated payment payload.

Systems and methods for transaction account tokenization

A system is configured for detecting a point of sale, receiving a personal identification number (PIN), generating a PIN based key using a message digest of the PIN, decrypting a data encryption key (DEK) using the PIN based key, and generating a DEK based dynamic key using the PIN based key. The system may also decrypt a session key using the DEK based dynamic key, generate a cryptogram from the session key, and send the cryptogram to the point of sale.

A system may receive a transaction request from a user device, and request an in-app cryptogram from a network software development kit (SDK) on the user device. The in-app cryptogram may include an unpredictable number, an application transaction counter (ATC), and a card verification result (CVR), and the ATC may be extracted from a limited use payment credential (LUPC). The system may transmit a token, a token expiry, and a token data block for an assessment by a payment network, with the token data block including the token, the token expiry, the ATC, and/or the in-app cryptogram. The system may further receive a request from the payment network to update the LUPC on the user device, and attest that the user device is secure in response to the request from the payment network to refresh the LUPC on the user device.

A system, method, and computer readable medium (collectively, the 'system') are provided. The system may include a processor configured to perform operations and/or steps comprising storing, by a processor, a session key on a mobile device, wherein the session key is encrypted. The system receiving a transaction request, decrypting the session key, and broadcasting a signal configured for being received by a magnetic stripe reader. Trackdata and/or trackdata may be encoded in the signal. The trackdata and/or the trackdata may also comprise a dynamically generated value that is generated based on the session key.

Host card emulation systems and methods

A system, method, and computer readable medium (collectively, the 'system') are provided. The system may include a processor configured to perform operations and/or steps comprising storing, by a processor, a session key on a mobile device, wherein the session key is encrypted. The system receiving a transaction request, decrypting the session key, and broadcasting a signal configured for being received by a magnetic stripe reader. Track 1 data and/or track 2 data may be encoded in the signal. The track 1 data and/or the track 2 data may also comprise a dynamically generated value that is generated based on the session key.

Growing community of inventors

Phoenix, AZ, United States of America

Ajay Babu Maddukuri