Visa International Service Association

Cohesity, Inc.

Sivanarayana Gaddam

Rohit Sinha

Atul Luykx

Gaven James Watson

Ranjit Kumar Kumaresan

Gyan Prakash

Pratyay Mukherjee

Hao Yang

Yogesh Lokhande

Mihai Christodorescu

Mahdi Zamani

Srinivasan Raghuraman

Biju Abraham

Bryan Carroll

Cuy Sheffield

Mohammad Mohsen Minaei Bidgoli

John Arendt

Gaurav Kohli

Yuexi Chen

Simon Hurry

Andreas Aabye

Suchit Kaura

Dean Galland

Di You

Zack Petersen

Vibhor Kumar

Techniques are described for protected data restoration using confidential computing. An example method comprises receiving, by a data platform implemented by a computing system, a request to restore an encrypted chunk of data, the encrypted chunk stored with first encrypted key data and second encrypted key data, receiving, by an enclave implemented in a trusted execution environment, first encrypted key data and second encrypted key data from the storage cluster, decrypting, by the enclave, the first encrypted key data to obtain the first key data and the second encrypted key data to obtain the second key data, generating, by the storage cluster, a derived data encryption key corresponding to the data encryption key based on the first key data and the second key data, and decrypting, by the storage cluster, the encrypted chunk with the derived data encryption key to generate a decrypted chunk.

Protected data restoration using confidential computing

Methods and systems for gateway agnostic tokenization are disclosed. Gateway agnostic tokenization enables a resource provider to quickly, safely, and efficiently route a token for authorization via any appropriate gateway computer. As part of an interaction with a user, a resource provider can transmit a token to an edge computer. The edge computer can then forward the token to a gateway computer. The gateway computer can identify a data item comprising two ciphertexts associated with the token. The edge computer and gateway computer can collectively decrypt the two ciphertexts to obtain a credential. The gateway computer can then forward the credential to an authorizing entity computer. The authorizing entity computer can then determine whether or not to authorize the interaction.

Gateway agnostic tokenization

A method includes generating, by a user device, an initial authorization request message for an interaction to obtain a resource from a resource provider. The user device transmits the initial authorization request message to a first node in a proxy network, wherein the first node processes the initial authorization request message and transmits a routing message to a second node in the proxy network based on the processing of the initial authorization request message, the second node being previously associated with the resource provider. The user device then receives from the second node and stores a pre-authorization approval indicator (PAAI). Upon delivery of the resource by an agent of the resource provider, the user device transmits an authorization request message including the pre-authorization approval indicator, wherein the agent device further processes and transmits the authorization request message to the proxy network for authorization by an authorizing entity.

Decentralized processing of interactions on delivery

An enhanced federated custodian system is described. One embodiment is directed to a computer system executing instructions to: receive, from one or more members of a federated blockchain on a network of computing devices, an approval for a transaction associated with an authentication capsule; generate, via a first trusted execution environment, a first machine readable code in response to receiving the approval for the transaction; transmit to a cold interaction system, the first machine readable code; and the cold interaction system comprising one or more processors and one or more memories, the one or more memories comprising instructions executable by the one or more processors to: receive the first machine readable code comprising the encrypted information and the approval; decrypt the encrypted information for the transaction and the approval; and generate a private key that corresponds to a public key for the transaction.

Federated custodian

Systems, methods, and computer program products for data security store, in memory, a plurality of ciphers in association with a plurality of public keys, the plurality of ciphers including a plurality of secret keys encrypted with a key encryption key, and the plurality of secret keys corresponding to the plurality of public keys; receive, a data chunk for encryption; generate, a data encryption key based on a hash function, a public key of the plurality of public keys, and a random number; encrypt, the data chunk with the data encryption key to generate an encrypted data chunk; generate, a header including a cipher of the plurality of ciphers corresponding to the public key of the plurality of public keys and key encapsulation data; and store, in a database, a cipher text including the header and the encrypted data chunk.

System, method, and computer program product for data security

A system, method, and computer program product for authenticating a user for a transaction; generate an electronic wallet key pair including an electronic wallet public key and a corresponding electronic wallet secret key, the electronic wallet key pair associated with an electronic wallet transaction processing system; receive a payment gateway public key corresponding to a payment gateway secret key, the payment gateway public key and the payment gateway secret key associated with a payment gateway system; generate a public re-encryption key based on the payment gateway public key; communicate, to the payment gateway system, the public re-encryption key; receive or determine encrypted transaction data associated with a transaction, the encrypted transaction data including an account identifier encrypted with the electronic wallet public key; re-encrypt the encrypted transaction data with the public re-encryption key; and communicate, to the payment gateway system, the re-encrypted transaction data.

System, method, and computer program product for authenticating a user for a transaction

A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (g), the second value (g) based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (m) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (m); generate, with the payment network, a public key (pk) based on the second value (g), the merchant product (M), and the random merchant number (m) and a random key (rk) based on the merchant product (M) and the random merchant number (m) for each respective merchant bank; and communicate, with the payment network, the public key (pk) and the random key (rk) to at least one respective merchant bank.

Method, system, and computer program product for network bound proxy re-encryption and PIN translation

A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (g), the second value (g) generated based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (m) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (m); generate, with the payment network, a public key (pk) based on the second value (g), the merchant product (M), and the random merchant number (m) and a random key (rk) based on the merchant product (M) and the random merchant number (m) for each respective merchant bank; and communicate, with the payment network, the public key (pk) and the random key (rk) to at least one respective merchant bank.

A method for securely rendering sensitive data is disclosed. A method for securely rendering sensitive data may include receiving account identifier data associated with at least one account identifier. The account identifier data may be converted into at least one non-textual visual element. The at least one non-textual visual element may be communicated to at least one receiver. The at least one receiver may render the at least one non-textual visual element. A system and computer program product are also disclosed.

Method, system, and computer program product for securely rendering sensitive data

Described are a system, method, and computer program product for secure real-time n-party computation. The method includes receiving a first computation input and a first portion of a one-time key from a first computer device, and receiving a second computation input and a second portion of the one-time key from a second computer device. The method also includes generating the one-time key based on the first and second portion of the one-time key, and executing a computation based on the first and second computation input. The method further includes generating an encrypted output by encrypting the computation with the one-time key, and communicating the encrypted output to the first computer device. The method further includes receiving a proof of publication from the first computer device and, in response to receiving the proof of publication, communicating the one-time key to the first computer device.

System, method, and computer program product for secure real-time N-party computation

A user can associate a digital asset corresponding to a value with a transaction device to be used by another user. For example, a first user can load a digital asset corresponding to a cryptocurrency amount onto a transaction device, where the first user then provides the transaction device to a second user. The second user can utilize the cryptocurrency amount on the transaction device to conduct a transaction. The generation and use of digital assets can be managed using ledgers that store data in the form of block chains.

Digital asset distribution by transaction device

Systems and methods for transferring value. A method includes posting, by a user device to a blockchain, a deposit transaction comprising a deposit value and conditions and updating, by the user device, a state according to a transaction amount. The method also includes transmitting, by the user device, a state update of the state to a server computer and responsive to transmitting the state update, and receiving, by the user device, a payment complete message comprising a tuple from the server computer. The method also includes verifying, by the user device, the conditions and processing, by the user device, a server deposit transaction on the blockchain in response to verifying.

Growing community of inventors

Santa Clara, CA, United States of America

Sivanarayana Gaddam