American Express Travel Related Services Company, Inc.

Manish K Deliwala

Ajay Babu Maddukuri

John G McDonald

Keshav A Narsipur

Jonathan Ward Lupton

Wael Ibrahim

Manik Biswas

Lisa C Yokoyama

Curtis Watson

Anthony Prentice

Andrew Lei

Jason E Muncey

Sreenivasan B Parameshwara

Subrahmanyam Venakata Vishnuvajhala

Naresh Bhandari

Manoj Krishnamma Thulaseedharan Pillai

Ashish Goulatia

Noreen Williams

Sandeep K Asokan

Michael J Bailey

Joe Buselmeier

Chintan Mehta

Keshav A Narispur

Manoj K Thulaseedharanpillai

Varaprasad Kotha

Rajesh K Namboodiri

Huei Ong

Santhosh R Rao

Manoj Krishnamma Thulassedharan Pillai

Brett A Vedas

Tony Prentice

A system may be configured to perform operations and/or steps comprising querying, by an issuer server, a network server for an alias associated with a transaction account. The issuer server may receive the alias from the network server. The issuer server may also send the alias to an issuer application. The operations may also comprise validating, by the issuer server, an account validation input entered into the issuer application. The issuer server may send an issuer signature criteria that indicate whether the account validation input is valid. The issuer application may add an alias associated with the account to a digital wallet.

Systems and methods for an account issuer to manage a mobile wallet

Disclosed are various embodiments for authentication with network connected computing resources using a cryptographic coprocessor installed on a client device. A request can be sent to the client device to provision an asymmetric encryption key-pair using a cryptographic coprocessor installed on the client device, wherein the request comprises a key-authorization credential for the asymmetric encryption key-pair and the asymmetric encryption key-pair comprises a public key and a private key. The public key of the asymmetric encryption key-pair and an identity public key for the cryptographic coprocessor can be received. The public key, key-authorization credential, and the identity public key can then be stored in association with each other.

Network authentication with cryptographic corpocessors

The system comprises approving a credit application during a single http session, transmitting an encoded secure token to a web-client participating in the http session, receiving from the mobile communications device the secure token, and transmitting the transaction account data to the mobile communications device, in response to the receiving the secure token. The system may further comprise the mobile communications device decoding the secure token.

Systems and methods for provisioning transaction data to mobile communications devices

Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, an exemplary method comprises transmitting, from an entity service to a client device, a key identifier and encrypted code that implements a cryptographic algorithm, wherein the encrypted code further includes an encryption key, wherein the key identifier identifies a particular root key that is associated with the entity service and is stored with a cryptographic coprocessor of the client device; receiving, by the entity service from the client device, a cryptogram that includes information encrypted using the cryptographic algorithm and the encryption key; and decrypting, by the entity service, the cryptogram using the encryption key.

Executing entity-specific cryptographic code in a cryptographic

Disclosed are various embodiments for securely conducting online in-application purchases. In one example, among others, a system comprises a computing device that is configured to identify a purchase request from a merchant application executed on the computing device and authenticate an account with a wallet provider based at least in part on a selection of the account. The computing device is configured to receive an instruction from the wallet provider to execute a security library and determine that the computing device is secure by executing a security library. The execution of the security library generates a device response for the wallet provider. A security code is determined data received from the wallet provider. A token is transmitted for the purchase request to the wallet provider based at least in part on the security code.

Systems and methods for in-application and in-browser purchases

A system, method, and computer readable medium (collectively, the 'system') are provided. The system may include a processor configured to perform operations and/or steps comprising receiving a selection of a transaction account to be used as payment for a transaction; and transmitting a wireless signal carrying emulated track data for payment of the transaction, wherein the emulated track data emulates data in tracks of a magnetic card and includes alias transaction account data in place of actual transaction account data.

Magnetic card swipe emulation systems and methods

Various embodiments for sending a cryptogram to a point of sale terminal while disconnected from a network. In some embodiments, for example, a computing device that is configured to display a prompt for a selection of a transaction account. An encrypted session key is retrieved through a network in response to determining a number of session keys associated with the transaction account is below a threshold. The computing device is also configured to generate a session key based at least in part on decrypting the encrypted session key using an encryption key and establish a wireless connection with a point of sale terminal for a purchase. A cryptogram is generated from the session key based at least in part on the user device being disconnected from the network. The cryptogram is sent to the point of sale terminal.

Sending a cryptogram to a POS while disconnected from a network

A system for using loyalty rewards accounts in a digital wallet may generate a mapping comprising an account mapped to a wallet token number and an indicator with the mapping stored in a database on a network of servers. The indicator may indicate an account type, and the wallet token number may be transmitted to a user device. The system may also receive a transaction request including a received wallet token number and a received indicator The indicator may be matched to the received indicator to determine the received wallet token number is associated with the account type (e.g., a loyalty rewards account). The system may route the transaction request to a loyalty settlement process in response to the account type being a loyalty rewards account.

Systems and methods for electronic payment using loyalty rewards

Systems, methods, and articles of manufacture for secured account provisioning and payments using user computing devices are provided. One such method comprises obtaining an account payload by the user computing device, wherein the account payload comprises a payment credential associated with a transaction account of a user of the user computing device; generating a storage encryption (ENC) key and a storage message authentication code (MAC) key based on at least a device fingerprint of the user computing device and a storage root key; encrypting, the account payload with the storage ENC key to form an encrypted account payload; generating a digital signature of the encrypted account payload using the storage MAC key; and storing the encrypted account payload and the digital signature in a secured database of the user computing device.

Secured account provisioning and payments for NFC-enabled devices

Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, an exemplary method comprises receiving encrypted code that includes implementing a cryptographic algorithm from a service via a network, wherein the encrypted code further includes a symmetric encryption key; decrypting, by a cryptographic coprocessor, the encrypted code; executing, by the cryptographic coprocessor, the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and sending the cryptogram to the service via the network.

Executing entity-specific cryptographic code in a cryptographic coprocessor

A system may identify a purchase transaction request from a merchant application and generate an in-app payment cryptogram for the purchase transaction request based on a limited use payment credential (LUPC). The in-app payment cryptogram may be provided to the merchant application. The merchant application may transmit the in-app payment cryptogram to a merchant computing device. A request may be received from a payment network to update the LUPC. A security library may be executed to determine that the client device is secure. The execution of the security library may generate a device attestation response, and the device attestation response is transmitted to the payment network. An updated LUPC may be received from the payment network.

A system, method, and computer readable medium (collectively, the 'system') are provided. The system may include a processor configured to perform operations and/or steps comprising receiving a wireless signal from a transaction device, wherein the wireless signal carries emulated track data for payment of a transaction; reading the emulated track data from the wireless signal; generating a transaction payload, wherein the transaction payload contains transaction account data and a dynamically generated digital signature value from the emulated track data of the wireless signal; transmitting the transaction payload to an authorization network server; receiving an authorization instruction from the authorization network server for handling payment of the transaction; and processing the payment of the transaction in accordance with the authorization instruction.

Transaction device use of a dynamically generated value based on a next expected session key

Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, encrypted code implementing a cryptographic algorithm is received from a service via a network. The cryptographic coprocessor decrypts the encrypted code. The cryptographic coprocessor executes the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm. The cryptogram is sent to the service via the network.

Systems, methods, and articles of manufacture for secured account provisioning and payments using near-field communication (NFC) enabled devices are provided. The system may receive an encrypted account provisioning request comprising a provisioning account and a device fingerprint; decrypt the encrypted account provisioning request with a server root key; retrieve a limited use payment credential (LUPC) based on the provisioning account; generate an ENC key, a MAC key, and a DEK key based on the device fingerprint and the server root key; and encrypt the LUPC using the ENC key, the MAC key, and the DEK key to generate an encrypted account payload.

Growing community of inventors

Chandler, AZ, United States of America

Manish K Deliwala