Mastercard International Incorporated

Eric Alger

Jenny Qian Zhang

Eric Trent Robins

Eric Devolder

Steven Patrick Bucher

Nathaniel David Byrd

Prashant Sharma

Cristian Radu

Jonathan James Main

Matthew Edward Hopkins

Brandon Craig Bryson

Joshua Joseph Baron

Gregg Alan Hill

Navjot S Sidhu

Moreshwar Mukund Datye

Richard David D'Erizans

Stephen Christopher Kirk

Justin Thomas Katen

Ashutosh Subhash Gijare

Krishna Prasad Vasireddy

Cynthia Elizabeth Pilling

John O'Neill

Medha Bhatt

Scott W Anderson, Jr

Matthew R Cahalin

Ryan T Dunn

James B Schelker

Christopher T Wischerth

Sasan Sahraei

Richard D D'ERIZANS

Justin T Katen

Cynthia E Pilling

John D O'NEILL

An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The custodian application transmits a request message to a centralized KMS requesting a data encryption key. In response, the centralized KMS returns the data encryption key. The custodian application transmits the authorization grant request to the centralized KMS and receives the authorization grant and encrypted data encryption key in return. The custodian application transmits the authorization grant and encrypted data encryption key to the cryptographic microservice application. The cryptographic microservice application transmits the authorization grant and encrypted data encryption key to the centralized KMS and receives the decrypted data encryption key in return.

Systems and methods for distributed cryptography as a service key loading

An application server has a custodian application running thereon. The server receives a command to instantiate a cryptographic microservice application on the application server. In response, the server instantiates the cryptographic microservice application. The cryptographic microservice application builds a secure enclave on the application server and, within the secure enclave, a cryptogram that represents a virtual fingerprint of the cryptographic microservice application. The server transmits the cryptogram to an authentication computing system. The server receives a digitally signed certificate from the authentication computing system and a data encryption key encrypted with a master tenant key from the custodian application. The server transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The server then receives the decrypted data encryption key from the authentication computing system.

Systems and methods for initializing a distributed cryptography as a service application

An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The custodian application transmits a first request message to a centralized KMS requesting a data encryption key. In response, the centralized KMS returns the data encryption key. The custodian application transmits a second request message to the cryptographic microservice application. The second request message includes a request for a wrapping certificate from the cryptographic microservice application. The custodian application receives the wrapping certificate. The custodian application transmits a third request message to the centralized KMS. The third request message includes the data encryption key encrypted via the master-level tenant key and the wrapping certificate. The custodian application also receives the data encryption key encrypted via the wrapping certificate and transmits it to the cryptographic microservice application. The cryptographic microservice application unwraps the wrapped key using the wrapping certificate.

An application server has a custodian application running thereon. The custodian application instantiates a cryptographic microservice. The cryptographic microservice application builds a white-box cryptographic enclave. The custodian application transmits a request for an authorization grant to an authentication computing system. In response, the authentication computing system returns the authorization grant. The custodian application transmits the authorization grant to the cryptographic microservice application. The cryptographic microservice application transmits the authorization grant to the authentication computing system and then receives a digitally signed certificate therefrom. The cryptographic microservice application receives a data encryption key from the custodian application. The cryptographic microservice application transmits a request to the authentication computing system. The request includes the digitally signed certificate, the data encryption key, and a request to decrypt the data encryption key. The cryptographic microservice application then receives the decrypted data encryption key from the authentication computing system.

A method for facilitating the broadcast of encrypted data includes: storing a content encryption key and a server private key of a first cryptographic key pair; storing a recipient profile, the profile being related to a recipient computing device including a recipient public key of a second cryptographic key pair; receiving a broadcast request from a broadcast computing device including an broadcast message encrypted using the content encryption key; identifying a unique identifier; transmitting a data message including the encrypted broadcast message and the unique identifier; receiving a key request from the recipient computing device including the unique identifier; verifying that the unique identifier included in the key request is equivalent to the identified unique identifier; encrypting the content encryption key using the recipient public key; and transmitting the encrypted content encryption key to the recipient computing device.

Method and system for managing centralized encryption and data format validation for secure real time multi-party data distribution

A method includes maintaining a digital wallet in a computer, and receiving a request for a transaction. The computer may receive and verify user authentication data, and then allow the user to access any payment card account in the digital wallet without requiring additional user authentication, regardless of the account selected for the transaction by the user. In some embodiments, cryptogram generation may be performed with an EMV server in association with the digital wallet, to enhance the level of security assurance for merchants, issuers and users.

Method and apparatus for streamlined digital wallet transactions

A security control (SC) system including one or more security control (SC) computing devices for automating security controls between computer networks is provided. The SC system is configured to receive a request to access a service including a system identifier that identifies a computer system requesting access to a service controlled by the one or more SC computing devices, build a token request based on the request, and correlate the token request to at least one security policy associated with the system identifier. The SC system is also configured to generate an access token in response to the token request, wherein the access token is included in an authorization request, and invoke the service using the authorization request. The SC system is further configured to validate the access token using the at least one security policy and authorize access to the service based on the at least one security policy.

Systems and methods for automating security controls between computer networks

A secure authorization server computer system for verifying an identity of an end-user is provided. The computer system is programmed to receive, from a computing client, an authentication request at an authorization component. The authentication request includes a secure authentication request identifier. The computer system is also programmed to validate the authentication request at the authorization component by validating the secure authentication request identifier. The computer system is further programmed to transmit an authentication response from the authorization component to the computing client. The authentication response includes an authorization code. The authorization code represents a validation of the authentication request.

Systems and methods for authenticating an online user using a secure authorization server

Systems and methods prevent fraudulent registration of devices associated with remuneration vehicles by bootstrapping the device to be registered with a bootstrap URL. The bootstrap URL may provide access to a registration server hosted by the vehicle provider. The vehicle provider may verify a single use of the bootstrap URL. Moreover, if access to the bootstrap URL is provided to the device, the vehicle provider may provide a server access communication to the device allowing the device and vehicle provider to set up a secure communication (even if communicating via an unsecure communication path). The secure communication may be used by the vehicle provider and the device to negotiate a symmetric communication key. At least the secure access communication and the symmetric communication key may operate based on one or more of an Elliptic Curve-, Diffie Hellman-, or Elliptic Curve Diffie Hellman (ECDH)-based secure connection scheme.

Systems and methods for secure communication bootstrapping of a device

A computer system for authenticating user access to at least one computer application of a plurality of computer applications is provided. The computer system includes a memory device and a processor. The computer system is programmed to identify a security level from a plurality of security levels for each computer application within the plurality of computer applications. The plurality of security levels include at least a first-tier security level and a second-tier security level. The second-tier security level requires additional authentication information as compared to the first-tier security level. The computer system is also programmed to create a user account for a user within the memory device with the first-tier security level, and to determine that the user account requires the second-tier security level, and prompt the user to enter the additional authentication information. The computer system is also programmed to promote the user account to the second-tier security level.

System and method for graduated security in user authentication

A method and system for securely propagating client identities in a service call from a first system to a target service system are provided. The system includes a memory device for storing data and a service provider (SP) computer system. The SP computer system is programmed to determine identities to transmit to the target system in association with a request, construct a data structure to represent each identity and additional information related to the identity, digitally sign the identity information, pair the identity information and the corresponding digital signature in a header of a request message from the first system to the target service system, receive the request message and extract the identity information and corresponding digital signatures from the header, validate the corresponding digital signatures, and construct using the corresponding identity information a data structure that represents each of the original identities established in the first system.

Method and system for propagating a client identity

A method and system for signing a digital certificate in real time for accessing a service application hosted within a service provider (SP) computer system through an open application programming interface (API) platform is provided. The API platform is in communication with a memory device. The method includes receiving registration data from a developer computer device wherein the developer computer device is associated with a developer and configured to store a developer application, receiving a certificate signing request (CSR) from the developer computer device wherein the CSR includes a public key associated with the developer, verifying the registration data as being associated with the developer, signing the CSR to produce a signed certificate after verifying the registration data wherein the verifying and signing steps are performed by the SP computer system in real time, and transmitting the signed certificate and a client ID to the developer computer device.

Growing community of inventors

Edwardsville, IL, United States of America

Eric Alger