Mastercard International Incorporated

Mastercard Ireland Limited

Mehdi Collinge

Patrik Smets

Michael C Ward

Simon Phillips

David Anthony Roberts

Cristian Radu

Fikret Ates

Mark Britten

Sandra Jansen

Omar Laazimani

Sebastien Pochic

Susan Thompson

Barry Alan Maidment

Axel Emile Jean Charles Cateland

Jonathan James Main

Patrick Mestré

Alan Johnson

Jean-Paul Edmond Rans

John Beric

Paul Vanneste

Dave Anthony Roberts

Ian Maddocks

Axel Cateland

Thomas Tan

Mohamed Abou El Enin

Andrea Bacioccola

John Gaitanos

Jonathan Grossar

Michael Ward

Michael Christopher Ward

A method of maintaining a secure relationship between a client device and a server is described. The client device receives a first challenge from the server and determines and provides a first response to the first challenge. A cookie is established associated with the secure relationship. This cookie is shared between the client and the server. To establish the secure relationship in a later interaction, the client provides the cookie to the server. The server then provides both the first challenge and a second challenge, to which the client determines a first response and a second response. The client then provides a composite response from which the first response and the second response are derivable by the server, allowing the server to be assured that the secure relationship exists. Each challenge uses a challenge function adapted to provide a fingerprint of the client device. Methods at both client and server, and suitably configured client and server, are also described.

Secure server client interaction

A method is described of managing service events in a distributed computing system. The distributed computing system comprises a plurality of computing nodes able to perform a service using a service process. The method takes place at one of the computing nodes. A service event is received or created. This service event is identified by a combination of a node identifier, a time element, and a local counter value. The local counter value represents a number of service events performed by a service process for a user since a last reset. The identified service event is then stored in a service process database according to node identifier and local counter values. The service process database is used to manage service events in the distributed system. Service events are removed from the service process database when no longer valid using the time element.

Event management in distributed computing system

A method for building an advanced storage key includes: storing, in a mobile device, at least (i) device information associated with the mobile device, (ii) program code associated with a first program including an instance identifier, and (iii) program code associated with a second program including a first key; generating a device fingerprint associated with the mobile device based on the device information via execution of the code associated with the first program; generating a random value via execution of the code associated with the first program; building a diversifier value based on the generated device fingerprint, the generated random value, and the instance identifier included in the code associated with the first program; and decrypting the built diversifier value using the first key stored in the code associated with the second program via execution of the code associated with the second program to obtain a storage key.

Method and system for generating an advanced storage key in a mobile device without secure elements

A method for generating payment credentials in a payment transaction includes storing, in a memory, at least a card master key associated with a transaction account. The method also includes generating, by a processing device, a first session key based on at least the stored card master key; generating, by the processing device, a second session key; generating, by the processing device, a first application cryptogram based on at least the first session key; generating, by the processing device, a second application cryptogram based on at least the second session key; and transmitting, by a transmitting device, at least the first application cryptogram and second application cryptogram for use in a payment transaction.

Method and system for secure authentication of user and mobile device without secure elements

A method is described of monitoring a service performed at a computing node. The computing node is one of a plurality of computing nodes in a distributed computing system. Each computing node is adapted to perform at least one service for clients. A monitoring process is adapted to monitor a service process performing the process. In the method, the monitoring process monitors the service process on performance of the service. The monitoring service then provides monitoring information to a monitoring process for another service process. A suitable computing node for performing the service is described, as is a coordinated monitoring service for supporting multiple monitoring services.

Monitoring in distributed computing system

A computing node in a distributed information security system, wherein the computing node is adapted to communicate with a subset of clients of the distributed information security system, wherein the computing node provides at least one cryptographic service for the clients of the subset, wherein the computing node is provisioned with a plurality of keys for use by said at least one cryptographic service, wherein the computing node is adapted to associate a key from the plurality of keys to a service request for a client according to a deterministic process based on one or more data associated with the client. A distributed information security system comprising a plurality of such nodes is also described, together with a method of providing a cryptographic service at such a computing node.

Credential management in distributed computing system

A method for generating cryptograms in a webservice environment includes: receiving, in a first environment of a computing system, a credential request transmitted by an external computing device using a secure communication protocol, the credential request including a transaction identifier and account identifier; transmitting, by the first environment, a data request to a second environment of the computing system, the data request including the account identifier; receiving, by the first environment, an account profile and session key from the second environment; transmitting, by the first environment, a cryptogram request to a third environment of the computing system, the cryptogram request including the account profile and session key; receiving, by the first environment, a cryptogram from the third environment generated using the account profile and session key; and transmitting, by the first environment, the cryptogram and transaction identifier to the external computing device via the secure communication protocol.

Method and system for generating cryptograms for validation in a webservice environment

A system and method for generating and provisioning payment credentials to a mobile device lacking a secure element includes receiving and storing by the mobile device a card profile from a remote system. The card profile may include payment credentials corresponding to a payment account and a profile identifier. The mobile device may receive a mobile personal identification number (PIN) input by a user of the mobile device and transmit a key request to the remote system. The mobile device may receive a single use key which may include an application transaction counter and a generating key from the remote system. The mobile device may generate a payment cryptogram valid for a single financial transaction based on the received single use key and the mobile PIN and transmit the payment credentials and the generated payment cryptogram to a point-of-sale terminal for use in a financial transaction.

Systems and methods for processing mobile payments by provisoning credentials to mobile devices without secure elements

A transaction processing system for sending user information data to a personal device, and an associated method are provided. The system comprises: a personal device, such as a balance display card; an interface device, such as a card reader for transmitting data to and from the card; a communications network connecting to the interface device; an issuer processor connected to the communications network; and a trusted network processor (TNP) processor connected to the communications network, interposed between the interface device and the issuer processor. The TNP processor is arranged to receive a transaction request message from a card user and to transmit a response message back to the personal device, the response message typically being a transaction authorization together with information for display on the card. The TNP processor is arranged to identify, dependent on properties of the transaction request message, whether the associated response message will require data to be sent to the user information device, and if so identified, to: route the transaction request message to the issuer processor using a standard message; receive the required data from the issuer processor using another standard message; match the received required data to the original request; generate an appropriate response message and script containing the required data; and transmit the response message back to the personal device thereby making the required information known to the user.

Delivery of information services to personal devices

A method for generating payment credentials in a payment transaction includes: storing, in a memory, at least a single use key associated with a transaction account; receiving, by a receiving device, a personal identification number; identifying, by a processing device, a first session key; generating, by the processing device, a second session key based on at least the stored single use key and the received personal identification number; generating, by the processing device, a first application cryptogram based on at least the first session key; generating, by the processing device, a second application cryptogram based on at least the second session key; and transmitting, by a transmitting device, at least the first application cryptogram and second application cryptogram for use in a payment transaction.

A cryptographic method of performing a tokenised transaction between a payment offering party and a payment accepting party is described. The tokenised transaction is mediated by a transaction scheme. The payment accepting party is provided with a merchant identity and a merchant certificate associated with that identity by the transaction scheme provider. The payment accepting party provides the merchant identity and transaction seed data to the payment offering party. The payment offering party validates the merchant identity and uses the merchant identity and the transaction seed data to generate a cryptogram for the tokenised transaction. The payment offering party provides the cryptogram to the payment accepting party for transmission to the transaction scheme provider for authorisation of the tokenised transaction. A suitable user computing device and merchant computing device for acting as payment offering party and payment accepting party respectively are also described.

Cryptographic authentication and tokenized transactions

Provided are a system and method for managing encryption keys used by a payment application on a mobile device. The method includes executing a mobile payment application in a user domain of the mobile device, where the user domain is an operating environment in which applications are executed and accessed by a user, importing a plurality of encryption keys for use by the mobile payment application into a system domain of the mobile device, where the system domain is a more secure operating environment controlled by an operating system, encrypting payment information of the mobile payment application in the system domain using one or more of the imported keys while executing the mobile payment application in the user domain, and transmitting the encrypted payment information to a merchant.

System and method for end-to-end key management

A mobile computing device has at least one processor and at least one memory together providing a first execution environment and a second execution environment logically isolated from the first execution environment. The following approach is taken to manage data items for an application executing the first execution environment. A trust relationship is established between a trust client in the second execution environment and a remote trusted party and the trust client receives one or more data items from the remote trusted party. On executing the application in the first execution environment, the trust client provides the data items or further data items derived therefrom to the application. Provision of these data items may be conditional upon a user authentication process. A suitable mobile computing device is also described.

Growing community of inventors

Mont-Sainte-Aldegonde, Belgium

Mehdi Collinge