Mastercard International Incorporated

Mastercard Technologies Canada Ulc

Emv Co. LLC

Mastercard Ireland Limited

Patrik Smets

David Anthony Roberts

Mehdi Collinge

Duncan Garrett

Patrick Mestré

Patrick Mestre

Eddy Van De Velde

Simon Phillips

Michael C Ward

Jonathan James Main

Eddy Lodewijk Hortensia Van De Velde

Philip Wei Ping Yen

Eddy L H Van De Velde

Axel Emile Jean Charles Cateland

Kuan Hua Chen

Christopher Bailey

Cristian Radu

Ronald D Carter

Paul Vanneste

Harjender Singh

Dave Anthony Roberts

Michihiko Yoden

Susan Thompson

Axel Cateland

Jean-Bernard Collet

Eddy Lodewijk Van De Velde

Jagdeep Singh Sahota

Ian David Alan Maddocks

Alan Johnson

Florent Hay

Trudy Hill

Jean-Paul Edmond Rans

Carole Oppenlander

Ian Maddocks

Patricia Bateson

Ramin Aghdaee

Joseph Pitcher

John Gaitanos

Mohamed Abou El Enin

Duncan Garret

Mike Cowen

Shilpa Harvey

Tim Stuart

Chirodeep Aikat

David Kenneth Meadon

Ian David Maddocks

Dave Roberts

Michael Ward

Michael Christopher Ward

A method for generating payment credentials in a payment transaction includes storing, in a memory, at least a card master key associated with a transaction account. The method also includes generating, by a processing device, a first session key based on at least the stored card master key; generating, by the processing device, a second session key; generating, by the processing device, a first application cryptogram based on at least the first session key; generating, by the processing device, a second application cryptogram based on at least the second session key; and transmitting, by a transmitting device, at least the first application cryptogram and second application cryptogram for use in a payment transaction.

Method and system for secure authentication of user and mobile device without secure elements

There is provided an authentication system for validating identity credentials of a user attempting to access a resource provided by a remote resource provision system. The authentication system includes an input configured to receive, from the resource provision system, an authentication request comprising a cryptographic representation of digital identity data of the user and an associated token identifier, where the digital identity data comprises at least one image of an identity credential of the user. The system also includes a processor configured to: determine a pre-stored cryptographic identifier corresponding to the token identifier; and compare the received cryptographic representation with the pre-stored cryptographic identifier. The system further includes an output configured to transmit, to the remote resource provision system and in response to determining a match between the received cryptographic representation and the pre-stored cryptographic identifier, an authentication confirmation indicating successful validation of the digital identity data.

Identity authentication and validation

A method of performing a contactless transaction between a payment device and a terminal is described. The method comprises establishing a data connection between the payment device and the terminal and then establishing if the payment device and the terminal both support an enhanced security architecture. If they do not, they will then perform the contactless transaction according to a basic transaction flow using a first cryptographic system. If they do, they will perform the contactless transaction according to an enhanced transaction flow using a second cryptographic system. The first cryptographic system and the second cryptographic system comprise different asymmetric cryptographic systems. Suitable payment devices and terminals, and methods at the payment devices and terminals, are described.

Security for contactless transactions

A method for generating cryptograms in a webservice environment includes: receiving, in a first environment of a computing system, a credential request transmitted by an external computing device using a secure communication protocol, the credential request including a transaction identifier and account identifier; transmitting, by the first environment, a data request to a second environment of the computing system, the data request including the account identifier; receiving, by the first environment, an account profile and session key from the second environment; transmitting, by the first environment, a cryptogram request to a third environment of the computing system, the cryptogram request including the account profile and session key; receiving, by the first environment, a cryptogram from the third environment generated using the account profile and session key; and transmitting, by the first environment, the cryptogram and transaction identifier to the external computing device via the secure communication protocol.

Method and system for generating cryptograms for validation in a webservice environment

A system and method for generating and provisioning payment credentials to a mobile device lacking a secure element includes receiving and storing by the mobile device a card profile from a remote system. The card profile may include payment credentials corresponding to a payment account and a profile identifier. The mobile device may receive a mobile personal identification number (PIN) input by a user of the mobile device and transmit a key request to the remote system. The mobile device may receive a single use key which may include an application transaction counter and a generating key from the remote system. The mobile device may generate a payment cryptogram valid for a single financial transaction based on the received single use key and the mobile PIN and transmit the payment credentials and the generated payment cryptogram to a point-of-sale terminal for use in a financial transaction.

Systems and methods for processing mobile payments by provisoning credentials to mobile devices without secure elements

Systems and methods are provided for extending dialogue between a mobile device and a point-of-interaction (POI). One example computer-implemented method includes receiving, by a conduit server, from the POI, via a first connection between the conduit server and the POI, a request for an extended connection between the POI and the mobile device, and notifying a host server of the request. The method then includes receiving, from the mobile device, via a second connection between the conduit server and the mobile device, an identifier for the mobile device and pairing, based on the identifier, the first and second connections, to establish a wireless connection between the POI and the mobile device, via the conduit server. The method further includes submitting a wake-up call to the mobile device, whereby the mobile device publishes the identifier to establish a wireless connection directly between the POI and the mobile device.

Systems and methods for use in enabling device-to-device communication, based on user interactions with the devices

Systems and methods relating to identity authentication and validation

Examples provide a system and method for initiating contactless communication sessions between computing devices using a variety of modalities. A user pre-registers a selected modality for triggering session initiation. A session initiation device generates trigger data based on a detected occurrence of a predetermined event corresponding to a user selected modality, such as, but not limited to, biometric data, a unique user identifier (ID), a vehicle identifier, or any other type of modality. The trigger data is mapped to a mobile device ID. The mobile device ID can be requested from a connection server. The communication session is established between the first computing device and the mobile user device using the mobile device identifier. The computing device transmits data to the mobile user device via the established communication session when the computing device is brought into proximity to the mobile user device.

Contactless communication session initiation between devices

A method for processing an encoded one-time number via payment rails includes: receiving, by a receiving device interfaced with a computing system, a one-time number, wherein the one-time number is comprised of at least an identification value and a remaining value; executing, by a querying module of the computing system, a query on a memory of the computing system to identify a routing number based on at least a portion of the one-time number; generating, by a generation module of the computing system, a data value, wherein the data value includes at least the identified routing number and the remaining value; and electronically transmitting, by a transmitting device of the computing system, the generated data value to an external system via payment rails associated with a payment network.

Method and system for conveyance of machine readable code data via payment network

A method for verification of a bearer of a credential device at a device reader is described. The method comprises first establishing a digital communication channel with the credential device, and then determining a set of verification options for the bearer and providing the set of verification options to the credential device over the digital communication channel. The credential device then selects a verification option from the set of verification options and communicates this to the device reader. The device reader can then verify the bearer of the credential device in accordance with the selected verification option. Methods at both the credential device and the device reader are described, as are suitably programmed credential devices and device readers.

User verification for credential device

Pursuant to some embodiments, systems, methods and computer program code are provided for receiving a transaction request message, the transaction request message specifying transaction attributes for a proposed payment transaction involving a user of a mobile device and a merchant, comparing the transaction attributes with a permitted transaction rule, the permitted transaction rule having been stored in the mobile device prior to receiving the transaction request message, approving the proposed transaction upon determining that the transaction attributes satisfy the permitted transaction rule, the approving including generating a transaction cryptogram, and transmitting the transaction cryptogram to the merchant for use in completing the proposed payment transaction.

Device-based transaction authorization

Methods and devices are provided for use in carrying out a transaction between a transaction device and a point of interaction. In connection therewith, a device for interacting with a point of interaction to carry out a transaction by a consumer includes a processor comprising a payment application and a system environment module, where the system environment module is configured to determine whether the payment application is eligible for a transaction. The device also includes an input in communication with the processor and configured to receive transaction data from a point of interaction in connection with the transaction, and an output in communication with the processor and configured to transmit transaction data to the point of interaction in connection with the transaction when the system environment module determines that the payment application is eligible for the transaction.

Electronic authentication systems

A method for generating payment credentials in a payment transaction includes: storing, in a memory, at least a single use key associated with a transaction account; receiving, by a receiving device, a personal identification number; identifying, by a processing device, a first session key; generating, by the processing device, a second session key based on at least the stored single use key and the received personal identification number; generating, by the processing device, a first application cryptogram based on at least the first session key; generating, by the processing device, a second application cryptogram based on at least the second session key; and transmitting, by a transmitting device, at least the first application cryptogram and second application cryptogram for use in a payment transaction.

Systems and methods are provided for use in extending dialogue between a mobile device and a point-of-interaction. One exemplary computer-implemented method includes receiving, at a point-of-interaction (POI) computing device, an identifier for an interaction with a user where the identifier is specific to a card associated with an account of the user or to the user in general, and submitting, by the POI computing device, a request for the identifier to a registration database to determine whether the account is registered for one or more services. The method then includes, in response to the request, receiving an encrypted action (associated with a service), encoding, by the POI computing device, a receipt for the interaction, and transmitting, by the POI computing device, the encoded receipt and the encrypted action to a host server for initiating the encrypted action between the POI computing device and a mobile device associated with the user.

Growing community of inventors

Nijlen, Belgium

Patrik Smets