Visa International Service Association

Hao Ngo

Christian Aabye

David William Wilson

Oleg Makhotin

Yuexi Chen

Erick Wong

Kiushan Pirzadeh

Brian Sullivan

John F Sheets

Dinah Sloan

Gustavo Mariath Zeiden

Chris Pitchford

Sanjeev Sharma

Christian Flurscheim

Olivier Brand

Eduardo Lopez

William Alexander Thaw

Christopher David Jones

Trudy Hill

Omar Rifaat

Joseph J Mirizzi

Lauren White

Abhishek Guglani

Bharatkumar Patel

Oleg Makarenko

Jarkko Oskari Sevanto

Tai Lung Burnnet Or

Thomas Bellenger

Michael Lindelsee

Guido Mangiagalli

Marc B Kekicheff

Gavin Shenker

Aparna Krishnan Girish

Mustafa Cemal Top

Fahimeh Rezaei

Mustafa Top

Mark Rigby

David Wilson

Kim R Wagner

Sunpreet Singh Arora

Saikrishna Badrinarayanan

Mike Lindelsee

Gaven James Watson

Srinivasan Raghuraman

Dave William Wilson

Gustavo Zeiden

Christopher Jones

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include encrypting account information with a first encryption key to generate a second encryption key, and encrypting key index information using the second key to generate a limited-use key (LUK). The key index information may include a key index having information pertaining to generation of the LUK. The LUK and the key index can be provided to the communication device to facilitate generation of a transaction cryptogram for a transaction conducted using the communication device, and the transaction can be authorized based on the transaction cryptogram generated from the LUK.

Limited-use keys and cryptograms

A method performed by at least a user device comprising an interaction application and a biometric application is disclosed. The method comprises receiving from an access device, a message comprising interaction details. The user device may perform a biometric verification of the user operating the user device. The method may then include, if the biometric application has a biometric verification result, the interaction application receives the biometric verification result from the biometric application and continues processing the message. Or if the biometric application does not have the biometric verification result, then the interaction application either waits for the biometric verification result from the biometric application or continues processing the message without the biometric verification result.

Method and system using conditional blocking and non-blocking query call system and method

A method is disclosed. The method comprises transmitting, by an access device to a communication device, a resource provider certificate and an access device certificate. Then, establishing a secure channel between the access device and the communication device using data from the resource provider certificate and the access device certificate. Then, transmitting to or receiving data from the communication device using the secure channel.

Efficient authentic communication system and method

A method is disclosed. The method includes generating, by a communication device during an interaction with an access device, a cryptogram using transaction level data and interoperability level data; transmitting the transaction level data and interoperability level data to the access device; and transmitting the cryptogram the access device, wherein the access device or a remote server computer in communication with the access device validates the received cryptogram before allowing the transaction to proceed.

Binding cryptogram with protocol characteristics

A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultra-wideband communication channel between the user device and the access device.

Secure on-demand ultra-wideband communication channels systems and methods

Systems and methods are disclosed for securely communicating sensitive data (e.g., interaction data) during a process for offline authentication. A data packet may be received by an access device from a user device in a one-way communication. The data packet may be converted to obtain interaction data comprising a digital certificate certified by the certificate authority and a digital signature value generated by the user device. A second public key associated with the user device may be obtained utilizing the digital certificate and the first public key associated with the certificate authority. The validity of the interaction data may be determined based at least in part on the digital signature value and the second public key associated with the user device. When the interaction data is determined to be valid, an identifier of the interaction data may be authorized and access may be provided based on this authorization.

Techniques for securely performing offline authentication

A system, apparatus, and method for processing payment transactions that are conducted using a mobile payment device that includes a contactless element, such as an integrated circuit chip. The invention enables one or more of the operations of activation of a payment application, transfer of transaction data, updating of account records, setting or re-setting of a payment application counter or register, or transfer or processing of a script, command, or instruction, with these functions being performed with minimal impact on a consumer. This is accomplished by introducing a pre-tap and/or two-tap operation prior to, or as part of, the transaction flow.

Method of performing transactions with contactless payment devices using pre-tap and two-tap operations

A method is disclosed. The method comprises receiving, by an identity network computer, a query set including a plurality of test identity attributes. After receiving the query set, the identity network computer may retrieve derivatives of identity attributes associated with a user, and an encrypted trapdoor, then compute an obscured query set using the query set, and optionally the derivatives of identity attributes. The identity network computer may transmit the obscured query set (i) and the encrypted trapdoor to a user device associated with the user, which generates and transmits a first modified trapdoor and the obscured query set to a relying party computer, or (ii) and a second modified trapdoor to the relying party computer. The relying party computer may thereafter use the obscured query set, and the first modified trapdoor or the second modified trapdoor, to determine if the identity attributes is a member of the query set.

Integrating identity tokens and privacy-preserving identity attribute attestations into interactions

A method includes forming a communication channel between a user device and an access device. The communication channel is then secured using a user device key pair in the user device and an access device ephemeral key pair in the access device. The access device then generates a session key using at least a private cryptographic key in the access device ephemeral key pair, and a public key in the user device key pair. The access device then uses the session key to secure an ultrawideband communication channel between the user device and the access device.

A system, apparatus, and method for processing payment transactions that are conducted using a mobile device that includes a contactless element, such as an integrated circuit chip. The invention enables the updating, correction or synchronization of transaction data maintained by an Issuer with that stored on the device. This is accomplished by using a wireless (cellular) network as a data communication channel for data provided by an Issuer to the mobile device, and is particularly advantageous in circumstances in which the contactless element is not presently capable of communication with a device reader or point of sale terminal that uses a near field communications mechanism. Data transferred between the mobile device and Issuer may be encrypted and decrypted to provide additional security and protect the data from being accessed by other users or applications. If encryption keys are used for the encryption and decryption processes, they may be distributed by a key distribution server or other suitable entity to a mobile gateway which participates in the data encryption and decryption operations.

Over the air update of payment transaction data stored in secure memory

A method is disclosed. The method includes receiving, by a user device from an access device, an available applications request message. The available applications request message includes an access device type identifier. The method also includes determining whether an association exists between the access device type identifier and one or more application identifiers of a plurality of application identifiers stored on the user device. The plurality of application identifiers respectively correspond to different applications on the user device. The method also includes transmitting, by the user device, to the access device, based in part on whether the association exists, an available applications response. The available applications response includes the one or more application identifiers of the plurality of application identifiers associated with the access device type identifier.

Terminal type identification in interaction processing

Growing community of inventors

San Jose, CA, United States of America

Hao Ngo