Transaction messaging

Patent metadata

Field	Value
Publication number	US-10769628-B2
Application number	US-201715495249-A
Country	US
Kind code	B2
Filing date	Apr 24, 2017
Priority date	Oct 24, 2014
Publication date	Sep 8, 2020
Grant date	Sep 8, 2020

Abstract

There is described a method for transmitting a transaction message from a transaction device having a transaction device identifier. The method involves encrypting, at a transaction device, a transaction device identifier, generating, at the transaction device, a transaction message for a transaction system, the transaction message comprising, at least, a first data field configured to hold a transaction device identifier and a second data field configured to hold supplementary data, and sending the transaction message to a transaction processing system. The generation of the transaction message comprises providing data in the first data field of the transaction message that does not identify the transaction device and providing the encrypted transaction device identifier in the second data field of the transaction message.

First claim

What is claimed is:

1. A method of processing a transaction message, wherein the transaction message conforms to an EMV standard in which the transaction message includes a first data field configured to hold a device identifier, a second data field configured to hold supplementary data, a third data field, and a fourth data field configured to hold data associated with a transaction, the method comprising:
receiving, by a transaction processing server, the transaction message from a first part of a transaction processing system, the transaction message comprising a temporary transaction device identifier in the first data field, an encrypted transaction device identifier in the second data field, an ephemeral public key P D in the third data field, and transaction data in the fourth data field;
generating, by the transaction processing server, a shared secret S using a private key d s of the transaction processing server and the ephemeral public key P D in the third data field;
decrypting, by the transaction processing server, the encrypted transaction device identifier in the second data field using the shared secret S to generate a transaction device identifier associated with a transaction device;
retrieving, by the transaction processing server, a hashing key K associated with the transaction device using the transaction device identifier;
calculating, by the transaction processing server, a hash value h′ of a concatenation of the transaction device identifier and the transaction data using the hashing key K;
generating, by the transaction processing server, a server generated ephemeral public key P′ D using the hash value h′;
validating, by the transaction processing server, the transaction data by comparing the server generated ephemeral public key P′ D with the ephemeral public key P D in the third data field; and
processing, by the transaction processing server, the transaction message using the transaction device identifier instead of the temporary transaction device identifier in the first data field.

2. The method of claim 1 , wherein the processing comprises sending a modified transaction message with the temporary transaction device identifier in the first data field replaced by the transaction device identifier to a second part of the transaction processing system.

3. The method of claim 2 , further comprising storing an association between the temporary transaction device identifier in the first data field and the transaction device identifier.

4. The method of claim 3 , further comprising:
receiving a response message from the second part of the transaction processing system, the response message comprising a data field configured to hold a device identifier, the data field comprising the transaction device identifier;
modifying the response message to replace the transaction device identifier with the temporary transaction device identifier in the first data field; and
sending the modified response message to the first part of the transaction processing system.

5. The method of claim 1 , wherein the transaction message comprises a fifth data field configured to hold further transaction data, and the method further comprises verifying the further transaction data using the ephemeral public key P D in the third data field.

6. The method of claim 1 , wherein the transaction message comprises a fifth data field configured to hold further transaction data, and wherein the further transaction data is used in decryption of the encrypted transaction device identifier.

7. The method of claim 5 , wherein a value uniquely associated with the transaction device identifier is used in verifying the further transaction data.

8. The method of claim 1 , wherein the transaction device identifier comprises data indicative of a primary account number of a financial instrument.

9. The method of claim 1 , wherein the temporary transaction device identifier is based on a random or pseudo-random number.

10. A computer system for processing a transaction message, wherein the transaction message conforms to an EMV standard in which the transaction message includes a first data field configured to hold a device identifier, a second data field configured to hold supplementary data, a third data field, and a fourth data field configured to hold data associated with a transaction, the computer system comprising:
a processor; and
a memory storing computer readable code, which when executed by the processor, causes the computer system to perform operations including:
receiving the transaction message from a first part of a transaction processing system, the transaction message comprising a temporary transaction device identifier in the first data field, an encrypted transaction device identifier in the second data field, an ephemeral public key P D in the third data field, and transaction data in the fourth data field;
generating a shared secret S using a private key d s of the computer system and the ephemeral public key P D in the third data field;
decrypting the encrypted transaction device identifier in the second data field using the shared secret S to generate a transaction device identifier associated with a transaction device;
retrieving a hashing key K associated with the transaction device using the transaction device identifier;
calculating a hash value h′ of a concatenation of the transaction device identifier and the transaction data using the hashing key K;
generating a system generated ephemeral public key P′ D using the hash value h′;
validating the transaction data by comparing the system generated ephemeral public key P′ D with the ephemeral public key P D in the third data field; and
processing the transaction message using the transaction device identifier instead of the temporary transaction device identifier in the first data field.

11. The computer system of claim 10 , wherein the processing comprises sending a modified transaction message with the temporary transaction device identifier in the first data field replaced by the transaction device identifier to a second part of the transaction processing system.

12. The computer system of claim 11 , wherein the operations further include storing an association between the temporary transaction device identifier in the first data field and the transaction device identifier.

13. The computer system of claim 12 , wherein the operations further include:
receiving a response message from the second part of the transaction processing system, the response message comprising a data field configured to hold a device identifier, the data field comprising the transaction device identifier;
modifying the response message to replace the transaction device identifier with the temporary transaction device identifier in the first data field; and
sending the modified response message to the first part of the transaction processing system.

14. The computer system of claim 10 , wherein the transaction message comprises a fifth data field configured to hold further transaction data, and the operations further include verifying the further transaction data using the ephemeral public key P D in the third data field.

15. The computer system of claim 10 , wherein the transaction message comprises a fifth data field configured to hold further transaction data, and wherein the further transaction data is used in decryption of the encrypted transaction device identifier.

16. The computer system of claim 15 , wherein a value uniquely associated with the transaction device identifier is used in verifying the further transaction data

Assignees

• Visa Europe Ltd

Inventors

• Sullivan Brian

Classifications

• G06Q20/401

  Transaction verification · CPC title

• G06Q20/3227 Primary

  using secure elements embedded in M-devices · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• G06Q20/4012 Primary

  Verifying personal identification numbers [PIN] · CPC title