Mastercard International Incorporated

Mastercard International Incorporated Purchase

Michael C Ward

David Anthony Roberts

Mehdi Collinge

Patrik Smets

Duncan Garrett

John Beric

Sandra Jansen

Susan Thompson

Alexandru Cunescu

David Bibby

Jonathan James Main

Paul Vanneste

Andrea Bacioccola

Mohamed Abou El Enin

A method for trusted notifications comprises: receiving, at a first host having at least one trusted server, a request message from a sender computing device, the request message comprising a request identifier and instructions to: update, at a second host, a recipient account associated with a recipient computing device, and to make a corresponding update at the first host to a sender account associated with the sender computing device. The method further comprises authorizing, at the first host, the request message; updating the sender account; generating a secure message at the at least one trusted server, the secure message comprising the request identifier and an indication from the at least one trusted server that the update completed; and sending the secure message from the first host to the sender computing device. The secure message can be received at the sender computer device and conveyed to the recipient computing device.

Method and system for trusted notifications

A system and method for generating and provisioning payment credentials to a mobile device lacking a secure element includes receiving and storing by the mobile device a card profile from a remote system. The card profile may include payment credentials corresponding to a payment account and a profile identifier. The mobile device may receive a mobile personal identification number (PIN) input by a user of the mobile device and transmit a key request to the remote system. The mobile device may receive a single use key which may include an application transaction counter and a generating key from the remote system. The mobile device may generate a payment cryptogram valid for a single financial transaction based on the received single use key and the mobile PIN and transmit the payment credentials and the generated payment cryptogram to a point-of-sale terminal for use in a financial transaction.

Systems and methods for processing mobile payments by provisoning credentials to mobile devices without secure elements

A method for generating transaction credentials for a user in a transaction, comprising: storing in a mobile device, an encrypted session key, and an encrypted user authentication credential; receiving an authorisation request; initiating a user authorisation process wherein in the event that the user is an authenticated user, the method comprises: decrypting the encrypted session key and encrypted user authentication credential; generating a transaction cryptogram in dependence on the user authentication credential and the session key; transmitting the transaction cryptogram and a user authentication status to a transaction processing entity for use in a transaction.

Transaction cryptogram

Provided are a system and method for managing encryption keys used by a payment application on a mobile device. The method includes executing a mobile payment application in a user domain of the mobile device, where the user domain is an operating environment in which applications are executed and accessed by a user, importing a plurality of encryption keys for use by the mobile payment application into a system domain of the mobile device, where the system domain is a more secure operating environment controlled by an operating system, encrypting payment information of the mobile payment application in the system domain using one or more of the imported keys while executing the mobile payment application in the user domain, and transmitting the encrypted payment information to a merchant.

System and method for end-to-end key management

A method for generating and provisioning payment credentials to a mobile device lacking a secure element includes: generating a card profile associated with a payment account, wherein the card profile includes at least payment credentials corresponding to the associated payment account and a profile identifier; provisioning, to a mobile device lacking a secure element, the generated card profile; receiving, from the mobile device, a key request, wherein the key request includes at least a mobile identification number (PIN) and the profile identifier; using the mobile PIN; generating a single use key, wherein the single use key includes at least the profile identifier, an application transaction counter, and a generating key for use in generating a payment cryptogram valid for a single financial transaction; and transmitting the generated single use key to the mobile device.

Systems and methods for processing mobile payments by provisioning credentials to mobile devices without secure elements

A method for enhanced validation of cryptograms for varying account number lengths includes: storing one or more primary account numbers and a plurality of formatting templates, each template being associated with an account number length; receiving a selection indicating a specific primary account number; identifying a specific formatting template where the associated account number length corresponds to a length of the specific primary account number; receiving an unpredictable number from a point of sale device; generating a cryptogram based on at least the unpredictable number and one or more algorithms; generating a data string, wherein the data string includes at least the generated cryptogram, the specific primary account number, and the unpredictable number, and wherein the data string is formatted based on the identified specific formatting template; and electronically transmitting the generated data string to the point of sale device.

Method and system for enhanced validation of cryptograms in cloud-based systems

A method of establishing a secure channel for communication between a first computing device and a second computing device is described. The method uses an elliptic curve Diffie-Hellman protocol, wherein G is an elliptic curve generator point and the first computing device has a unique private key dwith a public key Q=dG certified by a party trusted by the second computing device. The first computing device generates () a blinding factor r and sends () a blinded public key R=r&#xb7;Qto the second computing device. The second computing device generates () an ephemeral private key dand a corresponding ephemeral public key Q=dG and sends Qto the first computing device. The first computing device generates () K=KDF(r d&#xb7;Q) and the second computing device generates () K=KDF(d&#xb7;R), where KDF is a key derivation function used in both generation operations, to establish a secure channel between the first computing device and the second computing device. G is a point in the elliptic curve group E, wherein E is a group of prime order but E* is the quadratic twist of E and is a group of order m=z&#xb7;m' where m&#x2032; is prime and z is an integer, wherein r&#xb7;dis chosen such that z is a factor of r&#xb7;d. Suitable apparatus for performing the method is also described.

Secure channel establishment between payment device and terminal device

At least a first cryptogram and a second cryptogram are transmitted from a payment device reader component to a terminal component. A message including at least the first cryptogram and the second cryptogram is transmitted from the terminal component to an issuer of a payment device presented to the reader component, through a payment network. A message is obtained from the issuer, corresponding to authentication, by the issuer, of the payment device (and optionally the owner of the payment device) presented to the reader component, based at least on the first cryptogram and the second cryptogram. The payment network is configured in accordance with at least one of (i) a standard, and (ii) a specification, which normally employs only a single cryptogram for the message and the authentication. Apparatuses and computer program products are also disclosed.

Apparatus and method for combining cryptograms for card payments

A method for receiving and processing a data message includes: storing at least an encryption key; receiving a data message, the data message including at an encrypted message and a message authentication code, the message authentication code generated using at least a portion of the encrypted message; generating a reference authentication code using at least a portion of the encrypted message included in the received data message; validating the received data message based on a check of the message authentication code included in the received data message against the generated reference authentication code; and decrypting the encrypted message included in the received data message using the stored encryption key to obtain a decrypted message.

Method and system for secure transmission of remote notification service messages to mobile devices without secure elements

A method of generating an unpredictable number in a computing device is provided. The method comprises the computing device performing the following programmed steps: obtaining a plurality of data elements; performing a first one way function on an internal value P and the plurality of data elements to update the value P; and performing a second one way function on the value P to obtain the unpredictable number. A computing device adapted to perform this method is also described.

Unpredictable number generation

Techniques are provided for transaction adjustment. A payment device, having an offline balance, is presented to an offline terminal in connection with a putative transaction. If an irregularity with the putative transaction is detected, the offline balance is adjusted responsive to the detection. In one aspect of the invention, such adjustment can be carried out, via offline-terminal interaction, substantially without the use of a security module and cryptographic keys in the offline terminal.

Growing community of inventors

Northants, United Kingdom

Michael C Ward