Visa International Service Association

Atul Luykx

Sivanarayana Gaddam

Rohit Sinha

Hao Yang

Shashank Agrawal

Gaven James Watson

Wei Dai

Pratyay Mukherjee

Peter Rindal

Cuy Sheffield

Yuexi Chen

Simon Hurry

Payman Mohassel

Dmitri Bannikov

Andreas Aabye

Sergey Smirnoff

Selvaganesh Vasudevan

Systems, methods, and computer readable media are provided for improving the usability of a cryptogram generated in a first cryptographic protocol such as triple-DES. The methods may generate a first cryptogram using a first identifier in a first cryptographic protocol, stored in a key store within an insecure memory of the mobile communication device, generate, within a secure memory of the mobile communication device, a second cryptogram using a second identifier in a second cryptographic protocol, stored in the secure memory, combining, the first cryptogram and a number of characters of the second cryptogram equal to the length of the first cryptogram to generate a third cryptogram and transmitting the third cryptogram to an payment processing network to validate a transaction. A transaction associated with the third cryptogram may be validated by an authorization entity or an issue entity.

Mobile payments using multiple cryptographic protocols

An enhanced federated custodian system is described. One embodiment is directed to a computer system executing instructions to: receive, from one or more members of a federated blockchain on a network of computing devices, an approval for a transaction associated with an authentication capsule; generate, via a first trusted execution environment, a first machine readable code in response to receiving the approval for the transaction; transmit to a cold interaction system, the first machine readable code; and the cold interaction system comprising one or more processors and one or more memories, the one or more memories comprising instructions executable by the one or more processors to: receive the first machine readable code comprising the encrypted information and the approval; decrypt the encrypted information for the transaction and the approval; and generate a private key that corresponds to a public key for the transaction.

Federated custodian

A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (g), the second value (g) generated based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (m) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (m); generate, with the payment network, a public key (pk) based on the second value (g), the merchant product (M), and the random merchant number (m) and a random key (rk) based on the merchant product (M) and the random merchant number (m) for each respective merchant bank; and communicate, with the payment network, the public key (pk) and the random key (rk) to at least one respective merchant bank.

Method, system, and computer program product for network bound proxy re-encryption and PIN translation

A method including obtaining, by a key management computer, a key rotation period based on at least an adversarial storage limit. The key management computer can then generate a first cryptographic key. The key management computer can then generate a second cryptographic key to replace the first cryptographic key according to the key rotation period.

Computing key rotation period for block cipher-based encryption schemes system and method

Systems and methods for improved distributed symmetric cryptography are disclosed. A client computer may communicate with a number of cryptographic devices in order to encrypt or decrypt data. Each cryptographic device may possess a secret share and a verification share, which may be used in the process of encrypting or decrypting data. The client computer may generate a commitment and transmit the commitment to the cryptographic devices. Each cryptographic device may generate a partial computation based on the commitment and their respective secret share, and likewise generate a partial signature based on the commitment and their respective verification share. The partial computations and partial signatures may be transmitted to the client computer. The client computer may use the partial computations and partial signatures to generate a cryptographic key and verification signature respectively. The client computer may use the cryptographic key to encrypt or decrypt a message.

Distributed symmetric encryption

A smart device is provided between a transaction terminal (e.g. an access device, a point of sale terminal) and a payment card to facilitate a secure transaction. The smart device receives transaction details from the transaction terminal. The transaction terminal suspends the transaction. The smart device is brought in communication with a payment device in control of the user (e.g. the user of the payment device does not hand over the payment device to a merchant, clerk, waitstaff). The smart device receives a cryptogram identifying an account from the payment device and transmits the cryptogram to the transaction terminal. The transaction terminal resumes the transaction, generates a transaction authorization request message including the cryptogram, and transmits the transaction authorization request message to an issuer of the account. The transaction terminal receives an authorization response message from the issuer, and notifies the smart device of the transaction being approved or declined.

Smart device system and method of use

The system and methods described herein may be utilized to perform operations in a faster and less complex manner than provided by conventional systems. An encrypted record may be stored at a user device. The encrypted record may include entries related to operations that were previously requested by the user device. The encrypted record may have been encrypted using a dynamic value and a key that is associated with an entity associated with the user. A recipient computer of a request by the user device may be configured to utilize the dynamic value provided in the request and the key associated with the entity to derive the encryption key(s) last used to encrypt the record. The recipient computer may decrypt and modify the decrypted record to perform the requested operation while the user device is precluded from doing so.

Techniques for performing secure operations

The system and methods described herein may be utilized to perform operations in a faster and less complex manner than provided by conventional systems. An encrypted record may be stored at a user device. The encrypted record may include entries related to operations that were previously requested by the user device. The encrypted record may have been encrypted using a dynamic value and a key that is associated with an entity associated with the user. A recipient computer of a request by the user device may be configured to utilize the dynamic value provided in the request and the key associated with the entity to derive the encryption key(s) last used to encrypt the record. The recipient computer may decrypt and modify the encrypted record to perform the requested operation while the user device is precluded from doing so.

A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (ga), the second value (ga) generated based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (mi) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (mi); generate, with the payment network, a public key (pki) based on the second value (ga), the merchant product (M), and the random merchant number (mi) and a random key (rki) based on the merchant product (M) and the random merchant number (mi) for each respective merchant bank; and communicate, with the payment network, the public key (pki) and the random key (rki) to at least one respective merchant bank.

Growing community of inventors

San Francisco, CA, United States of America

Atul Luykx