Visa International Service Association

Visa U.s.a. Inc.

Kim R Wagner

John F Sheets

Sunpreet Singh Arora

Lacey Best-Rowden

Christian Aabye

Mark Allen Nelsen

Glenn Leon Powell

Gaven James Watson

Jing Jin

Srinivasan Raghuraman

Saikrishna Badrinarayanan

Jagdeep Singh Sahota

Trudy Hill

William Chi Yuen Chan

Saman Sarraf

Carole Oppenlander

Craig Allen Glendenning

Anita Ochieano

Kiushan Pirzadeh

Krishna Prasad Koganti

Igor V Karpenko

Simon Law

Sunit Lohtia

Frederick Liu

Paul Tait

Saloni Vijaykumar Mahajan

Dennis Franklin Olson

Sneha Sri Tadepalli

Marc Perl

Hector Rodriguez

Susan Zloth

Elianna Starr

Amy Dawson

Andres Jimenez

Jiayun He

Amisha Sisodiya

Jorge Andre Torres Perez Palacios

Binoy Parag Parikh

Sowmya Vuddaraju

Chunxi Jiang

Dinah Sloan

Marcelo Gomes De Oliveira

Mengjun Leng

Hao Ngo

Mihai Christodorescu

Shashank Agrawal

Brian Sullivan

Karen Louise Cervenka

Jason Blackhurst

Adam Clark

Brian Byrne

Mark Nelson

Jason Lightman

Sikhar Patranabis

Sue Zloth

Mark Allen Nelson

Systems and methods are disclosed in which data associated with a transaction are protected with encryption. At an access device, a PIN associated with a payment account may be encrypted with a first key derived from an initial key of the access device and sensitive data associated with the payment account may be encrypted with a second key derived from the initial key. At a secure module associated with a host server encrypted sensitive data of an authorization request message may be decrypted. The secure module associated with the host server can re-encrypt the sensitive data using a zone encryption key associated with a payment processing network. A translated authorization request message including the re-encrypted sensitive data can be transmitted by the merchant server to the payment processing network.

Data protection with translation

A method includes receiving a first encrypted first identity attribute. A first doubly encrypted first identity attribute is formed by encrypting the first encrypted first identity attribute. A second doubly encrypted first identity attribute is formed by encrypting the first encrypted first identity attribute. They are transmitted to a user device, which removes a user layer of encryption on each to form a second encrypted first identity attribute and a third encrypted first identity attribute. Layers of encryption are added to the second encrypted first identity attribute to form a third doubly encrypted first identity attribute and the third encrypted first identity attribute to form a fourth doubly encrypted first identity attribute. The server computer receives them and transmits, to the second identity provider computer, the fourth doubly encrypted first identity attribute. The second identity provider computer obtains a first identity attribute and compares it to a second identity attribute.

Secure data exchange matching across identity providers

Provided is a computer-implemented method for authenticating an identification document. The method includes determining, with at least one processor, whether image data associated with the identification document has at least one predetermined indicia. In response to determining that the image data has the at least one predetermined indicia, the method includes determining whether the at least one predetermined indicia corresponds to at least one invalidation mark on the identification document, and, in response to determining that the at least one predetermined indicia corresponds to the at least one invalidation mark, determining, that the identification document is invalid. In response to determining that the identification document is invalid, the method includes preventing or causing the prevention of at least one action from being performed. A system and computer program product for authenticating identification documents are also disclosed.

System, method, and computer program product for authenticating identification documents

A system, method, and computer program product is provided for secured, encrypted transaction processing. The method includes receiving a transaction request including a first user token including a first account balance, a second user token including a second account balance, and a transaction value. The method also includes generating a new first account balance by executing a zero-knowledge subtraction, and a new first user token including the new first account balance. The method further includes generating a new second account balance by executing a zero-knowledge addition, and a new second user token including the new second account balance. The method further includes transmitting the new tokens to the respective computing devices. The method further includes receiving a new transaction request including the new first user token and/or the new second user token, and generating a new account balance by executing a zero-knowledge computation based on the new transaction request.

System, method, and computer program product for secured, encrypted transaction processing

A method includes a server computer receiving, from a first data provider computer, encrypted data derived from first identity data and a cryptographic key or derivative thereof stored at the first data provider computer. The server computer transmits, to a second data provider computer, the encrypted data and/or the cryptographic key or derivative thereof. The server computer receives, from the second data provider computer, intermediate data derived from second identity data stored at the second data provider computer. The server computer determines if the first identity data and the second identity data are duplicates while the first identity data and the second identity data are encrypted. The server computer removes one of encrypted first identity data, derived from the first identity data, and encrypted second identity data, derived from the second identity data, from a memory in the server computer.

Privacy-preserving data deduplication

Provided is a computer-implemented method for authenticating a customer during payment transactions based on biometric identification parameters of the customer that includes receiving image data associated with an image template for identification of a customer, receiving image data associated with an image of a biometric identification parameter of the customer during a payment transaction between the customer and a merchant, establishing a short-range communication connection with a user device associated with the customer during the payment transaction between the customer and the merchant, authenticating an identity of the customer for the payment transaction via the short-range communication connection, determining an account identifier of an account of the customer based on authenticating the identity of the customer for the payment transaction, and processing the payment transaction using the account identifier of the account of the customer. A system and computer program product are also disclosed.

Authentication based on biometric identification parameter of an individual for payment transaction

A method is disclosed. The method includes receiving, by a processing network computer from a relying party computer associated with a relying party, a request for data associated with a user operating a user device. The processing network computer may retrieve first encrypted data of the user having a user-layer of encryption. The processing computer can then generate a second symmetric key to add a relying party-layer of encryption to the first encrypted data using a stream cipher. The doubly encrypted data may be transmitted to a user device that removes the user-layer of encryption on the first doubly encrypted data, and then adds a second relying party-layer of encryption to form second doubly encrypted data. The second doubly encrypted data may be transmitted to the relying party computer, which can remove both relying party-layers of encryption to gain access to the data associated with the user.

Privacy preserving identity data exchange based on hybrid encryption

Embodiments of the present invention are directed to methods, apparatuses, computer readable media and systems for securely processing remote transactions. One embodiment of the invention is directed to a method of processing a remote transaction initiated by a mobile device comprising a server computer receiving a payment request including encrypted payment information. The encrypted payment information being generated by a mobile payment application of the mobile device and being encrypted using a third party key. The method further comprises decrypting the encrypted payment information using the third party key, determining a transaction processor public key associated with the payment information, and re-encrypting the payment information using the transaction processor public key. The method further comprises sending a payment response including the re-encrypted payment information to a transaction processor. The transaction processor decrypts the re-encrypted payment information using a transaction processor private key and initiates a payment transaction.

Secure remote payment transaction processing

A user device generates an initiate interaction request message comprising a state commitment. The user device provides the initiate interaction request message to a first server computer, which creates a verify state request message comprising an interaction index, an interaction index commitment, and a first commitment signature formed from the state commitment and the interaction index commitment. The user device receives the verify state request message, then generates a modified verify state request message comprising a user device public key, the state commitment, the interaction index commitment, and the first commitment signature. The user device provides the modified verify state request message to a second server computer. The second server computer verifies the state commitment, verifies the first commitment signature, and creates a second commitment signature formed from the state commitment and the interaction index commitment. The user device receives a verify state response message comprising the second commitment signature.

Zero-knowledge interaction processing system and method

In a system for verifying transactions, when a user with a portable communication device nears a resource provider location, the portable communication device provides an indication to a transaction processing system of its proximity to the location. The portable communication device then provides a universally unique identifier (UUID) of a base station of the resource provider to the transaction processing system, which generates a hash using the UUID and a primary account number (PAN) of a portable transaction device that is associated with the portable communication device. When the user conducts a transaction with the portable transaction device at the provider, the provider generates a separate hash from the UUID and the PAN and sends the hash to the transaction processing system, A match between the hashes is taken into account as a positive indicator that the transaction is not fraudulent and the resource provider is complying with the system.

Multi-device authentication process and system utilizing cryptographic techniques

The invention is directed to a system that enables an authentication process that involves secure multi-party computation. The authentication process can be performed between a user device operated by a user and an access device. The user device and the access device may conduct the authentication process such that enrollment information and authentication information input by the user is not transmitted between the devices. Instead, the user device may determine and utilize obfuscated values associated with the authentication information. The user device may also determine an obfuscated authentication function that can be utilized to determine an authentication result without revealing enrollment information and authentication information associated with the user. The user can be authenticated based on the authentication result.

Authentication system using secure multi-party computation

A first biometric sample of a user is received by an access device from a user device. First biometric information is generated in an obscured format, based on the first biometric sample. A plurality of biometric information is received in an obscured format. The plurality of biometric information corresponds to a plurality of users, and was obtained from biometric samples of the plurality of users. The first biometric information in the obscured format is compared to the plurality of biometric information in the obscured format, and a match result is generated based on the comparing. The match result is provided to a server computer. Based on the match result, information indicating that one of the plurality of users that is associated with one of the plurality of biometric information is the user associated with the first biometric information is received.

Biometric validation process utilizing access device and location determination

Methods and systems for privacy-preserving identity attribute verification are presented. During an interaction between a relying entity and a user, a relying entity computer can transmit a policy token to a user device. The policy token may indicate the information needed by the relying entity in order to perform the interaction. The user device can verify the policy token, then use the policy token in conjunction with an identity token to generate a zero-knowledge proof. The user device may transmit the zero-knowledge proof to an identity service provider computer. The identity service provider computer may verify the zero-knowledge proof, then generate a verification message. The identity service provider computer may sign the verification message and transmit the signed verification message to the relying entity computer. The relying entity computer may verify the verification message and complete the interaction with the user.

Privacy-preserving identity attribute verification using policy tokens

Described herein are a system and techniques for detecting whether biometric data provided in an access request is genuine or a replay. In some embodiments, the system uses an machine learning model trained using genuine and replay sample data which is optimized in order to produce a result set in which results for the genuine samples are pulled closer to a genuine center and results for the replay samples are pushed away from the genuine center. Subjecting input biometric data (e.g., an audio sample) to the trained model results in a classification of the input biometric data as genuine or replay, which can then be used to determine whether or not to verify the input biometric data.

Replay spoofing detection for automatic speaker verification system

A method is disclosed. The method comprises receiving, by an identity network computer, a query set including a plurality of test identity attributes. After receiving the query set, the identity network computer may retrieve derivatives of identity attributes associated with a user, and an encrypted trapdoor, then compute an obscured query set using the query set, and optionally the derivatives of identity attributes. The identity network computer may transmit the obscured query set (i) and the encrypted trapdoor to a user device associated with the user, which generates and transmits a first modified trapdoor and the obscured query set to a relying party computer, or (ii) and a second modified trapdoor to the relying party computer. The relying party computer may thereafter use the obscured query set, and the first modified trapdoor or the second modified trapdoor, to determine if the identity attributes is a member of the query set.

Integrating identity tokens and privacy-preserving identity attribute attestations into interactions

Growing community of inventors

Sunnyvale, CA, United States of America

Kim R Wagner