Visa International Service Association

Visa Europe Limited

Brian Sullivan

Christian Aabye

Hao Ngo

Yuexi Chen

Gavin Shenker

Dinah Sloan

Sayeed Mohammed

Ramesh Shankar

Richard S Nassar

Clyde Valdez

Jonathan Hill

Quan Wang

Christian Flurscheim

Aparna Krishnan Girish

Fahimeh Rezaei

Pasan Chankama Hapuarachchi

Mark Rigby

Kim R Wagner

Sunpreet Singh Arora

Saikrishna Badrinarayanan

Gaven James Watson

Mustafa Cemal Top

Srinivasan Raghuraman

Mustafa Top

David Wilson

David Harbige

Methods of transaction authentication are provided. In one such method, at least one first transaction has been conducted, the or each first transaction generating data including first data comprising authentication data and second data identifying the or each first transaction, wherein a given first transaction is between a merchant and a card holder. A cryptographically signed and/or encrypted token corresponding to the given first transaction and comprising a characteristic of the first transaction has been generated using at least said second data. The cryptographically signed and/or encrypted token has been transmitted to the merchant. The method comprises receiving, from the merchant, data corresponding to a second transaction and in the event that the data corresponding to the second transaction includes the cryptographically signed and/or encrypted token, responsively authenticating the cryptographically signed and/or encrypted token, whereby to determine an authenticated association between the second transaction and a given first transaction.

Method of retaining transaction context

A method is disclosed. The method comprises transmitting, by an access device to a communication device, a resource provider certificate and an access device certificate. Then, establishing a secure channel between the access device and the communication device using data from the resource provider certificate and the access device certificate. Then, transmitting to or receiving data from the communication device using the secure channel.

Efficient authentic communication system and method

A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultra-wideband communication channel between the user device and the access device.

Secure on-demand ultra-wideband communication channels systems and methods

Techniques for managing an application token may include providing, by a first service provider application on a communication device to a first service provider computer, a first request for a first application token, receiving, by an account management application on the communication device from a token service computer in communication with the first service provider computer, the first application token, and storing the first application token in a token container in the account management application.

Token state synchronization

There is described a method for transmitting a transaction message from a transaction device having a transaction device identifier. The method involves encrypting, at a transaction device, a transaction device identifier, generating, at the transaction device, a transaction message for a transaction system, the transaction message comprising, at least, a first data field configured to hold a transaction device identifier and a second data field configured to hold supplementary data, and sending the transaction message to a transaction processing system. The generation of the transaction message comprises providing data in the first data field of the transaction message that does not identify the transaction device and providing the encrypted transaction device identifier in the second data field of the transaction message.

Transaction messaging

A method is disclosed. The method comprises receiving, by an identity network computer, a query set including a plurality of test identity attributes. After receiving the query set, the identity network computer may retrieve derivatives of identity attributes associated with a user, and an encrypted trapdoor, then compute an obscured query set using the query set, and optionally the derivatives of identity attributes. The identity network computer may transmit the obscured query set (i) and the encrypted trapdoor to a user device associated with the user, which generates and transmits a first modified trapdoor and the obscured query set to a relying party computer, or (ii) and a second modified trapdoor to the relying party computer. The relying party computer may thereafter use the obscured query set, and the first modified trapdoor or the second modified trapdoor, to determine if the identity attributes is a member of the query set.

Integrating identity tokens and privacy-preserving identity attribute attestations into interactions

A user device may receive (e.g., when proximate to the first access device), from an intervening device, device identification data for a first access device. A message may be received from a second access device via the intervening device. The message may include a digital signature generated based at least in part on second access device identification data. The user device may validate the message utilizing the digital signature and a public key. If the message is invalid, the user device may discard the message. If the message is valid, (e.g., unaltered), the user device may determine that the user has not confirmed an intent to interact with the second access device and may terminate a[n] further interaction with the second access device accordingly.

Systems and methods for protecting against relay attacks

A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultrawideband communication channel between the user device and the access device.

Systems, methods, and devices are disclosed for preventing relay attacks. A user device may receive (e.g., when proximate to the first access device), from an intervening device, device identification data for a first access device. A message may be received from a second access device via the intervening device. The message may include a digital signature generated based at least in part on second access device identification data. The user device may validate the message utilizing the digital signature and a public key. If the message is invalid, the user device may discard the message. If the message is valid, (e.g., unaltered), the user device may determine that the user has not confirmed an intent to interact with the second access device and may terminate an further interaction with the second access device accordingly.

A method is disclosed. The method includes receiving, by a user device from an access device, an available applications request message. The available applications request message includes an access device type identifier. The method also includes determining whether an association exists between the access device type identifier and one or more application identifiers of a plurality of application identifiers stored on the user device. The plurality of application identifiers respectively correspond to different applications on the user device. The method also includes transmitting, by the user device, to the access device, based in part on whether the association exists, an available applications response. The available applications response includes the one or more application identifiers of the plurality of application identifiers associated with the access device type identifier.

Growing community of inventors

Buckinghamshire, United Kingdom

Brian Sullivan