Dynamic offline encryption

Patent metadata

Field	Value
Publication number	US-10855663-B2
Application number	US-201916664561-A
Country	US
Kind code	B2
Filing date	Oct 25, 2019
Priority date	Nov 15, 2017
Publication date	Dec 1, 2020
Grant date	Dec 1, 2020

Abstract

A method for encrypting data when a device is offline is disclosed. In the method, a determination is made as to whether a successful connection with a remote server computer can or cannot be made. If a connection cannot be made, then data can be encrypted with an ephemeral public key. Later, then a connection is available, the encrypted data can be transmitted to the remote server computer for processing.

First claim

What is claimed is:

1. A method comprising:
receiving, by a processing computer, an authorization request message comprising encrypted access data and a key identifier from an access device via a communication network, wherein prior to receiving the authorization request message the access device determines that a successful connection with the processing computer cannot be made, encrypts access data with an ephemeral public key to form the encrypted access data, stores the encrypted access data, determines that a successful connection to the processing computer can be made, and transmits the encrypted access data and the key identifier to the processing computer in the authorization request message;
transmitting, by the processing computer to a key management server, a decryption request message comprising the encrypted access data and the key identifier;
receiving, by the processing computer from the key management server, decrypted access data;
generating, by the processing computer, a modified authorization request message comprising the decrypted access data; and
transmitting, by the processing computer, the modified authorization request message to an authorizing entity computer, wherein the authorizing entity computer determines whether or not an interaction associated with the decrypted access data is authorized.

2. The method of claim 1 further comprising:
receiving, by the processing computer from the authorizing entity computer, an authorization response message comprising an indication of whether or not the interaction is authorized; and
providing, by the processing computer, the authorization response message to the access device via the communication network.

3. The method of claim 2 , wherein the authorization response message further comprises the decrypted access data, wherein the method further comprises:
after receiving the authorization response message, replacing, by the processing computer, the decrypted access data in the authorization response message with the encrypted access data.

4. The method of claim 2 , wherein the authorization response message further comprises the decrypted access data, wherein the method further comprises:
after receiving the authorization response message, transmitting, by the processing computer, the authorization response message to the key management server, wherein the key management server re-encrypts the decrypted access data to form the encrypted access data; and
receiving, by the processing computer from the key management server, the authorization response message comprising the encrypted access data and the indication of whether or not the interaction is authorized.

5. The method of claim 4 , wherein transmitting the authorization response message to the key management server further comprises:
requesting, by the processing computer, the key management server to digitally sign the authorization response message, wherein the key management server digitally signs the authorization response message, and wherein the authorization response message further comprises a digital signature.

6. The method of claim 1 , wherein the key management server determines a private key based on the key identifier received from the processing computer in the decryption request message, and wherein the key management server decrypts the encrypted access data with the private key to form the decrypted access data, and wherein the key management server provides the decrypted access data to the processing computer.

7. The method of claim 6 , wherein prior to receiving the authorization request message, the access device receives the access data from a user.

8. The method of claim 7 , wherein the ephemeral public key and the private key are a public/private key pair associated with the key identifier, wherein the key management server generates the ephemeral public key, the private key, and the key identifier and provides the ephemeral public key, the private key, and the key identifier to the access device.

9. The method of claim 8 , wherein the key management server provides the ephemeral public key, the private key, and the key identifier to the access device via a coordination computer.

10. The method of claim 1 , wherein the access device attempts to transmit an initial authorization request message to the processing computer, and receives an error message in response to the initial authorization request message.

11. The method of claim 1 , wherein the processing computer is a network computer, and wherein the network computer is remotely located in reference to the access device.

12. A processing computer comprising:
a processor; and
a computer-readable medium coupled to the processor, the computer-readable medium comprising code executable by the processor for implementing a method comprising:
receiving an authorization request message comprising encrypted access data and a key identifier from an access device via a communication network, wherein prior to receiving the authorization request message the access device determines that a successful connection with the processing computer cannot be made, encrypts access data with an ephemeral public key to form the encrypted access data, stores the encrypted access data, determines that a successful connection to the processing computer can be made, and transmits the encrypted access data and the key identifier to the processing computer in the authorization request message;
transmitting, to a key management server, a decryption request message comprising the encrypted access data and the key identifier;
receiving, from the key management server, decrypted access data;
generating a modified authorization request message comprising the decrypted access data; and
transmitting the modified authorization request message to an authorizing entity computer, wherein the authorizing entity computer determines whether or not an interaction associated with the decrypted access data is authorized.

13. The processing computer of claim 12 , wherein receiving the authorization request message comprising the encrypted access data and the key identifier from the access device via the communication network, is further received via a transport computer disposed between the communication network and the processing computer.

14. The processing computer of claim 13 , wherein, prior to receiving the authorization request message, the access device receives the access data from a user.

15. The processing computer of claim 14 , wherein the key identifier is a first key identifier and the ephemeral public key is a first ephemeral public key, and wherein before the access device receives the access data from the user, the access device transmits a first key request message, to the key management server, comprising a request for the first key identifier, and the first ephemeral public key corresponding to a first ephemeral private key, and wherein the access device receives the first key identifier and the first ephemeral public key from the key management server.

16. The processing computer of claim 15 , wherein the key management server decrypts the encrypted access data of the decryption request message with the first ephemeral private key corresponding to the first key identifier.

17. The processing computer of claim 15 , wherein the method further comprises:
receiving, from the authorizing entity computer, an authorization response message comprising an indication of whether or not the interaction is authorized; and
providing the authorization response message to the access device via the transpo

Assignees

• Visa Int Service Ass

Inventors

• John Rhidian
• Prokop Bartlomiej Piotr
• Palmer Michael

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0457 Primary

  wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065) · CPC title

• H04L9/0825 Primary

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title