Visa Europe Limited

Stuart Fiske

Nicolas David Mackie

A method is disclosed. The method includes receiving a first session key different from a Master Key from a remote entity, the first session key based on the Master Key. The first session key is usable for a limited number of transactions. In response to receiving the first session key, the method includes provisioning a payment application in the user device with the first session key. The method includes receiving, at the payment application, a request for an application cryptogram from a point-of-sale terminal. In response to the receiving the request for the application cryptogram, the method includes generating the application cryptogram using the first session key, transmitting the application cryptogram to the point-of-sale terminal, and receiving a second session key from the remote entity. The second session key is based on the Master Key.

Payment system

Methods, apparatus and computer software are provided for authorizing an EMV transaction between a user device and a point of sale terminal, particularly, but not exclusively, in situations where a secure element is not made available for the deployment of a payment application on the user device. The payment application is instead deployed to a processing environment that is outside of any secure element on the user device. An ICC Master Key corresponding to the payment application is held by a trusted authority, such as the issuing bank. The trusted authority is adapted generate time-limited session keys on the basis of the ICC Master Key and distribute session keys to the payment application. Receipt of a session key by the payment application enables the payment application to conduct an EMV payment transaction. The session key is used to authorize a single EMV payment transaction.

Methods, apparatus and computer software are provided for authorizing an EMV transaction between a user device and a point of sale terminal, particularly, but not exclusively, in situations where a secure element is not made available for the deployment of a payment application on the user device. The payment application is instead deployed to a processing environment that is outside of any secure element on the user device. The payment application is associated with a certificate and a corresponding hash. The hash is adapted to be generated on the basis of an application expiration date parameter, which is adapted to comprise data indicative of an expiration date of day level granularity associated with the certificate. During processing of the EMV transaction, the point-of-sale terminal verifies the hash, thereby establishing the authenticity of the application expiration date, and hence the validity of the certificate.

Payment system for authorizing a transaction between a user device and a terminal

Methods and apparatuses are provided for configuring and using a contactless application on a chip within a portable device comprising input/output connections arranged to communicate with other devices via a contact connection and via a contactless connection. One such method comprises a first process and a second process. The first process comprises receiving, at the chip and from a first other device, a set of computer instructions, to be executed by the chip, to create a contactless application in a data store of the chip and initialise at least one file associated with the contactless application. The second process comprises executing, by the chip of the portable device, the contactless application, to transmit data to a second other device.

Extended data storage

Methods and apparatus are provided for configuring a contactless application on a chip within a portable device comprising input/output means arranged to communicate with other devices via a contact connection and via a contactless connection. One such method comprises a first process and a second process. The first process comprises receiving, at the chip and from a first other device, a set of computer instructions, to be executed by the chip, to create a contactless application in a data store of the chip and initialise at least one file associated with the contactless application. The first process further comprises configuring the contactless application in accordance with the set of computer instructions. The second process comprises executing, by the chip of the portable device, the contactless application, whereby to transmit data to a second other device. The first process is conducted via physical contact between the first other device and the portable device and the second process is conducted via contactless communication between the portable device and a contactless reader of the second other device.

Growing community of inventors

Guildford, United Kingdom

Stuart Fiske