Mastercard International Incorporated

Susan Thompson

David Anthony Roberts

Mehdi Collinge

Patrik Smets

Michael C Ward

Colin Tanner

Alan Mushing

Axel Emile Jean Charles Cateland

Clive Leader

Michael Christopher Ward

A system and method for generating and provisioning payment credentials to a mobile device lacking a secure element includes receiving and storing by the mobile device a card profile from a remote system. The card profile may include payment credentials corresponding to a payment account and a profile identifier. The mobile device may receive a mobile personal identification number (PIN) input by a user of the mobile device and transmit a key request to the remote system. The mobile device may receive a single use key which may include an application transaction counter and a generating key from the remote system. The mobile device may generate a payment cryptogram valid for a single financial transaction based on the received single use key and the mobile PIN and transmit the payment credentials and the generated payment cryptogram to a point-of-sale terminal for use in a financial transaction.

Systems and methods for processing mobile payments by provisoning credentials to mobile devices without secure elements

A method of refreshing key material is described for use in a trusted execution environment logically protected from a regular execution environment. The trusted execution environment further comprises a key identifier. New key material is received at the trusted execution environment to replace existing key material. The key identifier is set to a new value to indicate that new key material is present. The new value of the key identifier is provided directly or indirectly to other parties in association with cryptographic outputs provided by the trusted execution environment using the refreshed key material. This approach is described in connection with an application executing securely on a mobile device.

Cryptographic system management

A method for verifying the source of an authorization request includes: storing an integrated circuit card (ICC) master key; receiving an authorization request for a transaction, wherein the request includes an ICC dynamic number, and the ICC dynamic number is extracted from signed data, based on the ICC master key, generated by a payment card during combined data authentication (CDA); verifying the authenticity of the ICC dynamic number using the stored ICC master key; and transmitting the authorization request to a third party. A method for transmitting an authentic authorization request includes: storing payment card data, the data including an ICC master key associated with the payment card; authenticating the card data using CDA to generate signed data; extracting, from the signed data, an ICC dynamic number based on the ICC master key; and transmitting an authorization request for a transaction, the request including the extracted ICC dynamic number.

Method and system for the transmission of authenticated authorization requests

A method for generating and provisioning payment credentials to a mobile device lacking a secure element includes: generating a card profile associated with a payment account, wherein the card profile includes at least payment credentials corresponding to the associated payment account and a profile identifier; provisioning, to a mobile device lacking a secure element, the generated card profile; receiving, from the mobile device, a key request, wherein the key request includes at least a mobile identification number (PIN) and the profile identifier; using the mobile PIN; generating a single use key, wherein the single use key includes at least the profile identifier, an application transaction counter, and a generating key for use in generating a payment cryptogram valid for a single financial transaction; and transmitting the generated single use key to the mobile device.

Systems and methods for processing mobile payments by provisioning credentials to mobile devices without secure elements

A method for authenticating a computing device includes: storing an account profile, the profile including data related to a service account including an alphanumeric code; generating a session identifier and a seed value; computing a first hash using the session identifier; computing a second hash using the session identifier and the alphanumeric code; computing a third hash using the second hash and a utilized seed value; transmitting the session identifier to a computing device via a first communication protocol; transmitting the session identifier and first hash to a remote notification service for transmission to the computing device via a second communication protocol; receiving a fourth hash and the session identifier from the computing device via the first communication protocol; validating the fourth hash based on a comparison of the fourth hash and the computed third hash; and transmitting a validation result to the computing device based on the validation step.

Growing community of inventors

Burland, United Kingdom

Susan Thompson