Visa International Service Association

Inxeption Corporation

Visa International Service

Quan Wang

Yuexi Chen

Jerry Wald

Kelvan Patrick Howard

Shiv Bhatt

Jason Blackhurst

Steven Countway

Christian Aabye

Christian Flurscheim

Brian Sullivan

Mohamed Nosseir

Meredith Altenhofen

Yobel Muchang

Anil Somani

Pasan Chankama Hapuarachchi

Christopher Dean

Mayank Somaiya

Weiyi Zhou

Kyle Crouse

Mark R Moore

Erik Christopher Friend

Avinash Arumugam

Kevin Wong

Jacob Throgmorton

A blockchain system for ownership verification may include one or more issuer network nodes and one or more verification network nodes. An issuer network node may be configured to receive a request including a public key to issue a credential, provision the credential to the communication device, generate a payload derived from hashing the credential and the public key, store the payload in a record of a blockchain, and synchronize the record to other network nodes on the blockchain. A verification network node may be configured to receive the credential, the public key, and a signature generated by the communication device to request access to a resource, verify the signature using the public key, generate a hash value based on the credential and the public key, determine that the hash value is stored in the blockchain, and authenticate the communication device for access to the requested resource.

Methods and systems for ownership verification using blockchain

Systems, methods, and computer readable media are for providing a hand free interaction between a user and a dispenser device. A mobile communication device and a beacon device associated with the dispenser device (or the dispenser device operating as a beacon device) may perform mutual authentication with a federated platform. Once the entities are authenticated, the user is allowed to dispense the resource utilizing the dispenser device. Data associated with the interaction and related to the resource dispensed may be provided to the federated platform via the mobile communication device and the interaction data may be recorded. The federated platform may subsequently provide the interaction data to a resource provider to enable the resource provider to conduct a settlement process.

Federated closed-loop system

A reader device includes a processor; and a computer readable medium coupled to the processor. The computer readable medium including code, executable by the processor, to perform a method including: receiving, from a user device operated by a user, signed data and a cryptogram, wherein the signed data is determined by digitally signing data, which includes an electronic identifier associated with the user using a key stored in a secure element of the user device; determining, by the reader device, whether the cryptogram can be verified; and, upon verifying the cryptogram, sending, by the reader device, a request to a remote server computer to include the signed data in an electronic ledger.

Verification and encryption scheme in data storage

A method for efficiently storing and verifying records is disclosed. The method may comprise receiving a first hash of first interaction data and determining an interaction identifier associated with the first hash, then storing the first hash in a database along with the interaction identifier and determining a root hash of a hash tree. In addition, the method may also comprise providing the root hash of the hash tree to a public blockchain. Embodiments of the invention also allow users to easily present records to a third party or inquiring entity. Furthermore, interactions may be processed more quickly than previous blockchain methods that publish to a block during each individual interaction.

Compact recordation protocol

Embodiments of the invention are directed to a method for reducing a computational burden of a blockchain provider. A data processing computer may facilitate an exchange of a data transfer message between respective applications of a first and second device. The data processing computer may maintain an electronic record according to the exchange. A net transfer value may be determined for the record and data comprising the net transfer value may be transmitted to a blockchain provider. Receipt of the data by the blockchain provider may cause the blockchain provider to update a ledger with the net transfer value.

Techniques for secure blockchain management

A method is disclosed. The method includes receiving a broadcast signal from a beacon device, the broadcast signal encoding a first credential associated with a first entity. In response to receipt of the broadcast signal, the mobile communication device transmits the received first credential to an authentication system. The authentication system determines if the first entity associated with the broadcast signal is authentic and generates a confirmation message confirming the authenticity of the first entity. The mobile communication device then receives the confirmation message indicating that the first entity is authentic. The mobile communication thereafter receives and transmits a second credential for the mobile communication device to the beacon device, which transmits the second credential to the authentication system. The authentication system then confirms the authenticity of the mobile communication device. Then, the beacon device can initiate an interaction process with the user of the mobile communication device.

Hands free interaction system and method

Embodiments of the invention are directed to the utilization of trust tokens to perform secure message transactions between two devices. A trust token transmitted in a message from one device may include first data that is digitally signed by a trust provider computer, and second data that is digitally signed by the device itself. Upon receipt of a message containing a trust token, the recipient may utilize the first data to verify with the trust provider computer that the sender of the message is a trusted party. The trust provider computer may provide the recipient device the public key of the sender. The recipient may utilize the second data and the provided public key to verify that the sender signed the message and that the message is unaltered. These techniques may increase detection of relay, replay, or other man-in-the-middle attacks, decreasing the likelihood that such attacks will be successful.

Utilizing trust tokens to conduct secure message exchanges

A system and method are provided for generating access tokens on a user device rather than via a remote server computer. An access token can be generated on a second user device by combining and encrypting, with format preservation, a primary access identifier, variable value, and salt. The resulting value can be provided to a first user device that subsequently can provide the access token to an access device as a part of an interaction. The access device can generate an authorization request message that includes the access token and transmit the authorization request message to a remote server computer for processing. The remote server computer can process the access token to determine the primary access identifier despite not being involved in the generation of the access token, providing an improvement over conventional tokenization methods.

Token offline provisioning

A method for providing identification using an endpoint device is disclosed. The endpoint device may include an electronic identity that is unique and can be securely stored. The electronic identity may be passed to an access device along with signed interaction data and a cryptogram. The access device may generate an authorization request with the cryptogram and may send it to a remote server computer for further processing.

System and method for securely processing an electronic identity

Described herein are systems and methods for virtualizing policy enforcement amongst participants of an overlay network. In some embodiments, each of the participants may maintain a separate blockchain network. The overlay network may receive smart contracts or other policy documents that include information on interactions with a particular participant or between participants. A controller, which may be implemented on any node of the overlay network, may then extract an interaction algorithm from that smart contract that may be stored in policy data to be used in completing transactions between two participants of the overlay network. In some embodiments, the policy data may include cost data which may be used to determine how two entities may interact.

Blockchain network interaction controller

Embodiments of the invention enable a distributed ledger system including a network of entities that maintain an electronic ledger that can keep track of information related to events performed by various entities in the network. An operating entity may manage access to the distributed ledger system and may allow certain authorities and users to onboard with the distributed ledger system. A user device may generate a request to include data in the electronic ledger. The user device may generate a cryptogram and send the cryptogram with the request to a reader device, which may initiate a verification process to verify the cryptogram. If the cryptogram is verified, the data from the user device may be sent to one or more authorities so that it can be included in the electronic ledger.

Embodiments of the invention are directed to a method. The method may include transmitting, by a first device, an encrypted first biometric template generated from a first biometric sample of a user of the first device to a second device, wherein the second device inputs the encrypted first biometric template and a second biometric template generated from a second biometric sample of the user into a function to generate an encoded output. The first device may receive the encoded output from the second device, and may decode the encoded output to recover the encrypted first biometric template and the second biometric template of the user. Upon determining a match result between first and second biometric templates, the first device may transmit unique data to the second device.

Biometric data security system and method

A user device may receive (e.g., when proximate to the first access device), from an intervening device, device identification data for a first access device. A message may be received from a second access device via the intervening device. The message may include a digital signature generated based at least in part on second access device identification data. The user device may validate the message utilizing the digital signature and a public key. If the message is invalid, the user device may discard the message. If the message is valid, (e.g., unaltered), the user device may determine that the user has not confirmed an intent to interact with the second access device and may terminate a[n] further interaction with the second access device accordingly.

Systems and methods for protecting against relay attacks

A trust token may be created including authentication data for a user and his or her associated communication device. The trust token may be transmitted by the communication device to one or more recipients, such as a token server. The recipients may interpret the trust token and verify it against data written to one or more nodes of a blockchain when the user and the communication device registered for the trust token. Once the trust token is verified, the token server may be configured to generate, maintain, and provision account tokens representing sensitive data. The token server may push one or multiple account tokens to the communication device, thereby allowing the communication device to perform transactions with the account tokens. In other words, the implementation of a trust token may allow the communication device to be provisioned with multiple account tokens, without requiring multiple logins or transmissions of sensitive data.

System and method for generating trust tokens

Provided is a computer-implemented method for conducting a secure payment transaction for a purchase at a merchant using a client device and a remote point-of-sale (POS) system associated with the merchant. The method includes receiving, with a client device, at least one identifier for at least one product to be purchased, the at least one product associated with a transaction value, and detecting a checkout action with the client device. In response to detecting the checkout action, the method includes generating at least one transaction message based on the transaction value of the at least one item to be purchased and at least one account identifier, generating a cryptogram based at least partially on the at least one transaction message and the at least one issuer key, and transmitting the cryptogram to the remote POS system associated with the merchant. A system and computer program product are also disclosed.

Growing community of inventors

Foster City, CA, United States of America

Quan Wang