Mastercard International Incorporated

Visa International Service Association

Bruce John Rutherford

Stephen Orfei

Arthur D Kranzley

John F Sheets

Glenn Leon Powell

James John Anderson

Alan Mushing

Gregory D Williamson

John Robert Wankmueller

Fernando Lourenco

Mark Wiseman

Prashant Sharma

Carl M Campbell

Fikret Ates

Edward J Hogan

Mark Wiesman

Jean-Paul Edmond Rans

Mark Lulic

Didier Jean Marie Charles Paie

Art Kranzley

David Cutler

Alfred Dagher

Stephen W Orfei

Embodiments of the invention are directed to methods, apparatuses, computer readable media and systems for providing, along with a token, a token assurance level and data used to generate the token assurance level. At the time a token is issued, one or more Identification and Verification (ID&V) methods may be performed to ensure that the token is replacing a PAN that was legitimately used by a token requestor. A token assurance level may be assigned to a given token in light of the type of ID&V that is performed and the entity performing the ID&V. Different ID&Vs may result in different token assurance levels. An issuer may wish to know the level of assurance and the data used in generating the level of assurance associated with a token prior to authorizing a payment transaction that uses the token.

Network token system

A method for secured receipt and usage of payment credentials using a commercial-off-the-shelf (COTS) device includes: storing, in the COTS device, a secure application program and cryptographic keys; establishing, by the program, a secure communication channel with a back-end system inaccessible by any application program or component in the COTS device; exchanging attestation data between the program and the back-end system using the communication channel; receiving payment credentials from a payment card by a near field communication (NFC) interface in the COTS device; transmitting the payment credentials to the program by the NFC interface; enciphering, by the program, the payment credentials; and transmitting, by the program of the COTS device, the enciphered payment credentials to the back-end system using the secure communication channel.

Method and system for contactless transmission using off-the-shelf devices

Provided are a payment card, system and method for storing and reading tokenized payment account information from a payment card. In an exemplary embodiment, a payment card may include a substrate forming a body of the payment card, and an electronic chip attached to or included in the substrate. According to various exemplary embodiments, the electronic chip may include a storage storing tokenized payment account information corresponding to a payment account linked to the payment card. The electronic chip may be read by a payment terminal and may provide the tokenized payment information to the payment terminal during reading.

Payment card storing tokenized information

Method and system for contactless transmissions using off-the-shelf devices

A method for authentication facilitated via a trusted execution environment includes: reading payment credentials in a first application program stored in a first memory area of a computing device; transmitting an authentication request to a second application program stored in a trusted execution environment of the computing device separate from the first memory area; displaying a prompt for authentication data based on an instruction supplied by the second application program; receiving authentication data; transmitting the received authentication data to an external computing device; receiving, by the second application program of the computing device, an authentication result from the external computing device; and transmitting, by the second application program of the computing device, the authentication result to the first application program in response to the authentication request.

Method and system for authentication via a trusted execution environment

A Chip Authentication Program based on 3-D Secure protocols is provided for authenticating customers' on-line transactions. An issuer, who may be a payment card issuer, operates Access Control and Authentication Request Servers for authenticating transactions by individual customers who are identified by their personal EMV-complaint smart cards. An authentication token is generated at the point of interaction (POI) for each transaction based on information from the customer's smart card and transaction specific information sent directly by the issuer to populate a web page at the POI. Authentication tokens generated at the POI are evaluated by the Authentication Request Server to authenticate individual customer and/or card presence at the transaction POI. Authentication values are transported on-line in designated Universal Cardholder Authentication Fields consistent with 3-D Secure protocols.

Customer authentication in E-commerce transactions

A system and computer-based method for performing a financial transaction using an interchange computer coupled to a database, the interchange computer and database associated with an interchange network, the transaction initiated by a cardholder with a merchant. The method includes receiving, at the interchange computer, a payer authentication request message from the merchant, the payer authentication request message associated with the cardholder and including data representing at least one of transaction card brands supported for payment, a response time limit, and item purchase information. The cardholder is prompted to enter access credential information. The entered access credential information is verified at the interchange computer. The cardholder is prompted to select a transaction card from one or more transaction cards associated with the cardholder. A payer authentication response message including transaction card data associated with the selected transaction card is transmitted from the interchange computer to the merchant.

Methods and systems for performing a financial transaction

In a secure electronic payment system, authentication data based on a payment account (e.g., a credit card account) is sent from an authentication server, through a user's Web browser, to a merchant's computer. The merchant's computer sends the authentication data to a computer operated by the issuer of the payment account, either through a payment organization computer or through an acquirer computer operated by the merchant's acquirer. The issuer's computer verifies the authorization request message, thereby generating an authorization response message. The authorization response message is forwarded to the merchant's computer, either through the payment organization computer or through the acquirer computer. If the authorization response message indicates that the verification was successful, the transaction is completed.

System and method for conducting secure payment transaction

A formatted data structure is provided for conveying the results of ecommerce authentication programs that are used to authenticate a cardholder's on-line transactions. The data structure, which has at most a 20-byte length, is designed to be compatible with 3-D Secure message protocols used in e-commerce. The data structure includes designated fields that include a hash of the merchant's name, identify an authentication service provider, identify the authentication method used, and include a merchant authentication code which ties cardholder information to the transaction. Secure payment algorithms are provided for use by the e-commerce authentication programs to generate authentication results in the desired format. In one secure payment algorithm, a secret key is used to encrypt a concatenation of a cardholder account number with information from designated fields of the data structure. In another secure payment algorithm, a pair of secret keys is used to encrypt a concatenation of the cardholder's account number, card expiration date and service code. In both cases, portions of the encryption results are used to define the merchant authentication code.

Systems and methods for conducting secure payment transactions using a formatted data structure

In accordance with the present invention, when an appropriate transaction message is received by a payment gateway, instead of requesting an authorization of the transaction through the payment network, the payment gateway instead sends an authorization response back to the message originator. The payment gateway may perform authentication functions and send transaction data back to the message originator. In this way, the payment gateway may be used for authentication functions while the message originator may use its existing payment system protocols to conduct authorization functions.

Method and system for conducting secure electronic commerce transactions with authorization request data loop-back

In a secure electronic payment system, authentication data is sent from a payment account issuer to user software operated by a purchaser. The user software sends the authentication data to a merchant using hidden fields on the Web page of the merchant. The merchant generates an authorization request message based upon the authentication data. The authorization request message is sent to a payment organization either directly from the merchant or via the merchant's acquirer. The payment organization forwards the authorization request message to a payment account issuer which verifies the authorization request message, thereby generating an authorization response message which is sent to the payment organization. The payment organization forwards the authorization response message to the merchant, either directly or via the acquirer.

Growing community of inventors

Stamford, CT, United States of America

Bruce John Rutherford