American Express Travel Related Services Company, Inc.

Wael Ibrahim

Upendra S Mardikar

Manish K Deliwala

Manik Biswas

Andrew Lei

Subrahmanyam Venakata Vishnuvajhala

Disclosed are various embodiments for authentication with network connected computing resources using a cryptographic coprocessor installed on a client device. A request can be sent to the client device to provision an asymmetric encryption key-pair using a cryptographic coprocessor installed on the client device, wherein the request comprises a key-authorization credential for the asymmetric encryption key-pair and the asymmetric encryption key-pair comprises a public key and a private key. The public key of the asymmetric encryption key-pair and an identity public key for the cryptographic coprocessor can be received. The public key, key-authorization credential, and the identity public key can then be stored in association with each other.

Network authentication with cryptographic corpocessors

Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, an exemplary method comprises transmitting, from an entity service to a client device, a key identifier and encrypted code that implements a cryptographic algorithm, wherein the encrypted code further includes an encryption key, wherein the key identifier identifies a particular root key that is associated with the entity service and is stored with a cryptographic coprocessor of the client device; receiving, by the entity service from the client device, a cryptogram that includes information encrypted using the cryptographic algorithm and the encryption key; and decrypting, by the entity service, the cryptogram using the encryption key.

Executing entity-specific cryptographic code in a cryptographic

A system and method for automated remote payments between a vehicle and a refueling station is disclosed. The system may enable the vehicle to initiate an automated remote payment to the refueling station without needing the user to manually input transaction account information, or to manually prepay for the transaction. The refueling station may detect when the vehicle is in proximity, and the vehicle and the refueling station may open communications to transmit data. The vehicle may transmit vehicle identifying data to the refueling station, and the refueling station may communicate the vehicle identifying data to a payment network to authorize the transaction. In response to authorizing the transaction, the vehicle may proceed with refueling at the refueling station.

Automated remote payments between a vehicle and a refueling station

Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, an exemplary method comprises receiving encrypted code that includes implementing a cryptographic algorithm from a service via a network, wherein the encrypted code further includes a symmetric encryption key; decrypting, by a cryptographic coprocessor, the encrypted code; executing, by the cryptographic coprocessor, the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm and the symmetric encryption key; and sending the cryptogram to the service via the network.

Executing entity-specific cryptographic code in a cryptographic coprocessor

A system and method is disclosed for automated remote transactions between a vehicle and a lodging system. The system may enable the vehicle to initiate an automated remote transaction to the lodging system to book an accommodation and complete a remote payment. The lodging system may transmit available accommodations to the vehicle. The vehicle may respond with a booking request comprising an accommodation selection and vehicle identifying data and the lodging system may communicate the vehicle identifying data to a payment network to authorize the remote transaction. In response to authorizing the remote transaction, the lodging system may complete the booking request with the vehicle.

Automated remote transactions between a vehicle and a lodging system

Disclosed are various embodiments for executing entity-specific cryptographic code in a cryptographic coprocessor. In one embodiment, encrypted code implementing a cryptographic algorithm is received from a service via a network. The cryptographic coprocessor decrypts the encrypted code. The cryptographic coprocessor executes the decrypted code to generate a cryptogram including information encrypted using the cryptographic algorithm. The cryptogram is sent to the service via the network.

A system may generate a seed one-time password (OTP). The system may also perform steps including transmitting the seed OTP to a user device, receiving a response OTP from the user device, and calculating an expected response OTP by applying a function to the seed OTP. The system may then compare the response OTP to the expected response OTP and send a result in response to comparing the response OTP to the expected response OTP.

Applying a function to a password to determine an expected response

Systems for decoupling and updating pinned certificates on a user device are disclosed. A mobile application having a hardcoded pinned certificate may be installed on a user device. The pinned certificate may be decoupled from the mobile application and stored on the user device. In response to the mobile application attempting to establish a secure connection with a server, the system may check whether the decoupled pinned certificate is current by querying a certificate repository. In response to determining that the pinned certificate is out of date, the system may transmit the current certificate to the user device to update the decoupled pinned certificate.

Decoupling and updating pinned certificates on a mobile device

A system for conducting transactions without a debit card or credit card may receive a request to complete a transaction including authentication data associated with a transaction account and a captured biometric template. The transaction request may lack information contained on a typical debit card or credit card. The system may identify the transaction account using the authentication data associated with the transaction account. The transaction account may be associated with a stored biometric template stored in a biometric data store. The system may also compare the stored biometric template with the captured biometric template. In response to the stored biometric template conflicting with the captured biometric template, the system may decline the transaction.

Transaction approval based on a scratch pad

A system receives a source and a metadata layer that describes the source. The source may comprise source records with fields containing source data, and the metadata layer may include metadata comprising at least one of a field data type, a field data length, a field description, or a record length. The processor may further validate the metadata layer against the source and write results to a log. The processor may further be configured for transforming the source records into transformed records for a load ready file. The processor may further balance a number of records in the source against a number of transformed records in the load ready file to generate a transformation failure rate.

Growing community of inventors

San Diego, CA, United States of America

Wael Ibrahim