Visa International Service Association

Visa U.s.a. Inc.

Other

Visa Intellectual Service Association

Christian Aabye

Hao Ngo

David William Wilson

Oleg Makhotin

Kiushan Pirzadeh

Erick Wong

Christian Flurscheim

Jagdeep Singh Sahota

Jing Jin

Kim R Wagner

Glenn Leon Powell

Sanjeev Sharma

Christopher David Jones

John F Sheets

Trudy Hill

Brian Sullivan

Yuexi Chen

Igor V Karpenko

Dinah Sloan

Ayman A Hammad

William Alexander Thaw

Gustavo Mariath Zeiden

Chris Pitchford

Eduardo Lopez

William Chi Yuen Chan

Carole Oppenlander

Anita Ochieano

Craig Allen Glendenning

Patrick L Faith

Gyan Prakash

Eric Fernand Le Saint

Ajit Gaddam

Olivier Brand

Joseph J Mirizzi

Lauren White

Abhishek Guglani

Bharatkumar Patel

Jarkko Oskari Sevanto

Tai Lung Burnnet Or

Oleg Makarenko

Sasikumar Kannappan

Christopher C Jones

Simon Hurry

Jalpesh Chitalia

Thomas Bellenger

Frederick Liu

Michael Lindelsee

Andreas Aabye

Guido Mangiagalli

Michael Middlemas

Selim Aissi

Quan Wang

Gavin Shenker

Phil Dixon

Vishwanath Shastry

Taeho Kgil

Aparna Krishnan Girish

Sonia Reed

Kevin D Weller

Dominique Fedronic

Mohamed Nosseir

Chandra Srivastava

Robert Youdale

Bryan Carroll

Brijendra Singh

Paul Hilliar

Fahimeh Rezaei

Alexandre Pierre

Pasan Chankama Hapuarachchi

Adam Clark

Christopher Dean

Mark Rigby

Marcelo Gomes De Oliveira

Christopher McMillan

Eric Schindewolf

John Francis Benedict Bourdillon

Marc B Kekicheff

Mike Lindelsee

Sayeed Mohammed

Mustafa Cemal Top

Eric Le Saint

Phillip Lavender

Mustafa Top

Dave William Wilson

Christoffel Jacobs

Pawel Chrobok

A method is disclosed. The method comprises transmitting, by an access device to a communication device, a resource provider certificate and an access device certificate. Then, establishing a secure channel between the access device and the communication device using data from the resource provider certificate and the access device certificate. Then, transmitting to or receiving data from the communication device using the secure channel.

Efficient authentic communication system and method

An issuing authority (IA) may validate the identity of a user and issue a digital license to the user. IA may generate IA public-private key pair, and provide IA public key to the certification authority (CA). IA may sign the digital license with IA private key, and provision the signed digital license on the user device. IA may request CA to certify the digital license. CA may use IA public key to validate the digital license, and sign IA public key with CA private key, thereby generating a digital certificate associated with the issuing authority that is linked to the digital license. A relying party may use CA public key to validate the digital license. The relying party can retrieve the information from the digital license and trust that the retrieved information is legitimate.

Method and system for authentication credential

Methods and systems for performing efficient integration tests on mobile device for contactless data transfers are described. Rather than performing contactless communications with a variety of test user devices (e.g., test smart cards), which may be time consuming and may present physical difficulty, a mobile device can simulate the result of these communications using a simulator application operating on the mobile device. A contactless communication application, also operating on the mobile device, can communicate with the simulator application in order to generate interaction payloads based on stored data records corresponding to the test user devices. These interaction payloads can then be transmitted by the mobile device to a processing computer. Later, the mobile device may receive a response from the processing computer or another computer system, indicating if the interaction payloads were successfully received and interpreted. This in turn may indicate if the integration test was successful.

Simulator application on mobile device for integration testing

Systems and methods are for confidentially and securely provisioning data to an authenticated user device. A user device may register an authentication public key with an authentication server. The authentication public key may be signed by an attestation private key maintained by the user device. Once the user device is registered, a provisioning server may send an authentication request message including a challenge to the user device. The user device may sign the challenge using an authentication private key corresponding to the registered authentication public key, and may return the signed challenge to the provisioning server. In response, the provisioning server may provide provisioning data to the user device. The registration, authentication, and provisioning process may use public key cryptography while maintaining confidentiality of the user device, the provisioning server, and then authentication server.

Confidential authentication and provisioning

A method is disclosed. The method includes receiving, by an access control server, an authentication request message comprising a credential or a token from an access device, after the access device receives the credential or the token from a portable device of a user. The method also includes responsive to receiving the authentication request message, transmitting, by the access control server, a challenge message to a user device associated with the user; generating, by the access control server, an authentication indicator. The method also includes transmitting, by the access control server, an authentication response message including the authentication indicator to the access device.

User authentication at access control server using mobile device

A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultra-wideband communication channel between the user device and the access device.

Secure on-demand ultra-wideband communication channels systems and methods

Embodiments of the present invention are directed to methods, apparatuses, computer readable media and systems for securely processing remote transactions. One embodiment of the invention is directed to a method of processing a remote transaction initiated by a mobile device comprising a server computer receiving a payment request including encrypted payment information. The encrypted payment information being generated by a mobile payment application of the mobile device and being encrypted using a third party key. The method further comprises decrypting the encrypted payment information using the third party key, determining a transaction processor public key associated with the payment information, and re-encrypting the payment information using the transaction processor public key. The method further comprises sending a payment response including the re-encrypted payment information to a transaction processor. The transaction processor decrypts the re-encrypted payment information using a transaction processor private key and initiates a payment transaction.

Secure remote payment transaction processing

In a system for verifying transactions, when a user with a portable communication device nears a resource provider location, the portable communication device provides an indication to a transaction processing system of its proximity to the location. The portable communication device then provides a universally unique identifier (UUID) of a base station of the resource provider to the transaction processing system, which generates a hash using the UUID and a primary account number (PAN) of a portable transaction device that is associated with the portable communication device. When the user conducts a transaction with the portable transaction device at the provider, the provider generates a separate hash from the UUID and the PAN and sends the hash to the transaction processing system, A match between the hashes is taken into account as a positive indicator that the transaction is not fraudulent and the resource provider is complying with the system.

Multi-device authentication process and system utilizing cryptographic techniques

Embodiments of the invention are directed to access transactions. A gate access device may interact with a payment card such as a credit card. The gate access device may generate and transmit a first authorization request message to a payment processing network computer. The first authorization request message does not include an amount for the transaction, but only contains identification information. A first authorization response message is transmitted back to the gate access device. At a later point in time, a second authorization request message containing the transaction amount is transmitted from the gate access device to the issuer, and a response is received from the issuer.

Online authentication in access transactions

A system, apparatus, and method for processing payment transactions that are conducted using a mobile payment device that includes a contactless element, such as an integrated circuit chip. The invention enables one or more of the operations of activation of a payment application, transfer of transaction data, updating of account records, setting or re-setting of a payment application counter or register, or transfer or processing of a script, command, or instruction, with these functions being performed with minimal impact on a consumer. This is accomplished by introducing a pre-tap and/or two-tap operation prior to, or as part of, the transaction flow.

Method of performing transactions with contactless payment devices using pre-tap and two-tap operations

A reader device may include a midrange wireless transceiver, a controller coupled to the midrange wireless transceiver, and a memory coupled to the controller. The memory may store executable code, which when executed by the controller, causes the reader device to implement various operations including maintaining a transaction service attributes database in the memory. The operations may also include broadcasting a beacon including a transaction service indicator at a periodic interval using the midrange wireless transceiver, receiving a connection request from a communication device, and establishing a wireless connection with the communication device. The operations may further include performing an application selection process with the communication device, performing application data processing with the communication device, and performing authorization request processing for the communication device.

Mid-range reader interactions

Systems and methods are disclosed for securely communicating sensitive such as an identifier. A user device may receive a first message comprising a terminal type indicator. For certain values of the terminal type indicator, the user device may be configured to transmit a request message comprising a first identifier and an encrypted identifier. For other values of the terminal type indicator, the user device may be configured to generating an obfuscated identifier based at least in part on a first portion of a second identifier and a second portion of the encrypted identifier. The user device may then transmit a request message that includes the obfuscated identifier and the encrypted identifier.

Techniques for securely communicating sensitive data for disparate data messages

A user device may receive (e.g., when proximate to the first access device), from an intervening device, device identification data for a first access device. A message may be received from a second access device via the intervening device. The message may include a digital signature generated based at least in part on second access device identification data. The user device may validate the message utilizing the digital signature and a public key. If the message is invalid, the user device may discard the message. If the message is valid, (e.g., unaltered), the user device may determine that the user has not confirmed an intent to interact with the second access device and may terminate a[n] further interaction with the second access device accordingly.

Systems and methods for protecting against relay attacks

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include using a limited-use key (LUK) to generate a transaction cryptogram, and transmitting a token instead of a real account identifier and the transaction cryptogram to an access device to conduct the transaction. The token and the transaction cryptogram can be transmitted to a magnetic stripe reader by generating an emulated magnetic signal. The LUK may be associated with a set of one or more limited-use thresholds that limits usage of the LUK, and the transaction can be authorized based on at least whether usage of the LUK has exceeded the set of one or more limited-use thresholds.

Cloud-based transactions with magnetic secure transmission

Growing community of inventors

Foster City, CA, United States of America

Christian Aabye