Limited-use keys and cryptograms

Patent metadata

Field	Value
Publication number	US-11164176-B2
Application number	US-201414577678-A
Country	US
Kind code	B2
Filing date	Dec 19, 2014
Priority date	Dec 19, 2013
Publication date	Nov 2, 2021
Grant date	Nov 2, 2021

Abstract

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include encrypting account information with a first encryption key to generate a second encryption key, and encrypting key index information using the second key to generate a limited-use key (LUK). The key index information may include a key index having information pertaining to generation of the LUK. The LUK and the key index can be provided to the communication device to facilitate generation of a transaction cryptogram for a transaction conducted using the communication device, and the transaction can be authorized based on the transaction cryptogram generated from the LUK.

First claim

What is claimed is:

1. A method for enhancing security of a communication device when conducting a transaction using the communication device, the method comprising:
encrypting, by a computer system, account information with a first encryption key to generate a second encryption key;
encrypting, by the computer system, key index information using the second encryption key to generate a limited-use key (LUK), wherein the key index information includes a key index having a counter value indicating a number of times that the LUK has been renewed in a predetermined time period, and time information indicating when the LUK is generated, and wherein the LUK is associated with a set of one or more limited-use thresholds that limits usage of the LUK; and
providing, by the computer system, the LUK and the key index to the communication device via an application platform computer;
receiving, by the computer system, the key index information and a transaction cryptogram generated by the communication device, the transaction cryptogram including transaction data encrypted by the LUK;
verifying, by the computer system, that the transaction cryptogram was encrypted using the LUK, and that the LUK has not exceeded the one or more limited-use thresholds, wherein verifying that the transaction cryptogram was encrypted using the LUK includes:
regenerating the transaction cryptogram using the received key index information; and

based on the verifying, authorizing the transaction.

2. The method of claim 1 , wherein verifying that the transaction cryptogram was encrypted using the LUK includes:
comparing a result of the regenerating to the received transaction cryptogram.

3. The method of claim 1 , wherein the transaction is conducted without using a secure element.

4. The method of claim 1 , wherein the set of one or more limited-use thresholds limits the number of transactions that can be conducted using the LUK.

5. The method of claim 1 , wherein the account information includes a token that is a substitute for an account identifier.

6. The method of claim 1 , wherein the first encryption key is a master derivation key associated with an issuer of an account associated with the account information.

7. The method of claim 6 , wherein the second encryption key is a unique derivation key for the account.

8. The method of claim 1 , wherein encrypting the account information with the first encryption key to generate the second encryption key includes:
encrypting the account information using the first encryption key to generate a first portion of the second encryption key;
inverting the account information; and
encrypting the inverted account information using the first encryption key to generate a second portion of the second encryption key.

9. The method of claim 1 , wherein encrypting the key index information using the second encryption key to generate the LUK includes:
padding the key index with a first value to generate a first padded key index information;
encrypting the first padded key index information to generate a first portion of the LUK;
padding the key index with a second value to generate a second padded key index information; and
encrypting the second padded key index information to generate a second portion of the LUK.

10. The method of claim 1 , wherein the transaction cryptogram is generated by:
enciphering transaction information using a first portion of the LUK;
deciphering the enciphered transaction information using a second portion of the LUK; and
re-enciphering the deciphered transaction information using the first portion of the LUK.

11. The method of claim 1 , wherein the transaction cryptogram is generated by:
encrypting a predetermined numeric string using the LUK; and
decimalizing the encrypted predetermined numeric string.

12. The method of claim 11 , wherein decimalizing the encrypted predetermined numeric string includes:
extracting numeric digits from the encrypted predetermined numeric string to form a first data block;
extracting hexadecimal digits from the encrypted predetermined numeric string and converting each extracted hexadecimal digit into a numeric digit to form a second data block; and
concatenating the first data block and the second data block.

13. A computer system for enhancing security of a communication device when conducting transactions using the communication device, the computer system comprising:
one or more processors; and
one or more memories storing computer-readable code, which when executed by the one or more processors, causes the computer system to perform operations including:
encrypting account information with a first encryption key to generate a second encryption key;
encrypting key index information using the second encryption key to generate a limited-use key (LUK), wherein the key index information includes a key index having a counter value indicating a number of times that the LUK has been renewed in a predetermined time period, and time information indicating when the LUK is generated, and wherein the LUK is associated with a set of one or more limited-use thresholds that limits usage of the LUK;
providing the LUK and the key index to the communication device via an application platform computer;
receiving the key index information and a transaction cryptogram generated by the communication device, wherein the transaction cryptogram includes transaction data encrypted by the LUK;
verifying that the transaction cryptogram was encrypted using the LUK, and that the LUK has not exceeded the one or more limited-use thresholds, wherein verifying that the transaction cryptogram was encrypted using the LUK includes:
regenerating the transaction cryptogram using the received key index information; and

based on the verifying, authorizing the transaction.

14. The computer system of claim 13 , wherein verifying that the transaction cryptogram was encrypted using the LUK includes:
comparing a result of the regenerating to the received transaction cryptogram.

15. The computer system of claim 13 , wherein the transaction is conducted without using a secure element.

16. The computer system of claim 13 , wherein the set of one or more limited-use thresholds limits the number of transactions that can be conducted using the LUK.

17. The computer system of claim 13 , wherein the account information includes a token that is a substitute for an account identifier.

18. The computer system of claim 13 , wherein the first encryption key is a master derivation key associated with an issuer of an account associated with the account information.

19. The computer system of claim 18 , wherein the second encryption key is a unique derivation key for the account.

20. The computer system of claim 13 , wherein encrypting the account information with the first encryption key to generate the second encryption key includes:
encrypting the account information using the first encryption key to generate a first portion of the second encryption key;
inverting the account information; and
encrypting the inverted account information using the first encryption key to generate a second portion of the second encryption key.

21. The computer system of claim 13 , wherein encrypting the key index information using the second encryption key to generate the LUK includes:
padding the key index with a first value to generate a first padded key index information;
encrypting the first padded key index information to generate a first portion

Assignees

• Visa Int Service Ass

Inventors

• Ngo Hao
• Aabye Christian
• Sheets John
• Makhotin Oleg

Classifications

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• H04L2209/20

  Manipulating the length of blocks of bits, e.g. padding or block truncation · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title