Method, system, and computer program product for network bound proxy re-encryption and PIN translation

Patent metadata

Field	Value
Publication number	US-12256009-B2
Application number	US-202318212779-A
Country	US
Kind code	B2
Filing date	Jun 22, 2023
Priority date	Jan 9, 2019
Publication date	Mar 18, 2025
Grant date	Mar 18, 2025

Abstract

A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (g a ), the second value (g a ) based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (m i ) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (m i ); generate, with the payment network, a public key (pk i ) based on the second value (g a ), the merchant product (M), and the random merchant number (m i ) and a random key (rk i ) based on the merchant product (M) and the random merchant number (m i ) for each respective merchant bank; and communicate, with the payment network, the public key (pk i ) and the random key (rk i ) to at least one respective merchant bank.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
generating, with at least one point-of-sale (POS) terminal, a random number (r) for a transaction message (m) associated with a transaction, wherein the transaction message (m) contains sensitive data, and wherein the sensitive data comprises an identification number associated with a user;
generating, with the at least one POS terminal, a first ciphertext associated with the transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with the transaction message (m), the first ciphertext value encrypted based on the random number (r), a generator value (g), and the transaction message (m); and
ii) a second ciphertext value associated with the random number (r), the second ciphertext value encrypted based on the random number (r) and a terminal public key;

communicating, with the POS terminal, the first ciphertext to at least one payment gateway;
re-encrypting, with the at least one payment gateway, the second ciphertext value based on a terminal random key to transform the second ciphertext value to a re-encrypted second ciphertext value based on a second value (g a ), a merchant product (M), and the random number (r);
communicating, with the at least one payment gateway, the re-encrypted second ciphertext value and the first ciphertext value to at least one respective merchant bank of a plurality of merchant banks;
re-encrypting, with the at least one respective merchant bank of the plurality of merchant banks, the re-encrypted second ciphertext value to transform the re-encrypted second ciphertext value to a second re-encrypted second ciphertext value;
communicating, with the at least one respective merchant bank, the second re-encrypted second ciphertext value and the first ciphertext value to a payment network;
decrypting, with the payment network, the first ciphertext value to form the transaction message (m) based on the second re-encrypted second ciphertext value, the merchant product (M), a random merchant number (m i ), and the first ciphertext value;
communicating, with the payment network, the transaction message (m) associated with the transaction to a consumer bank;
verifying, with the consumer bank, the identification number associated with the user; and
in response to verifying the identification number, authorizing, with the consumer bank, the transaction.

2. The computer-implemented method of claim 1 , further comprising:
generating, with the payment network, a first value (a) and the second value (g a ), the second value (g a ) generated based on the first value (a) and the generator value (g);
generating, with the payment network, a plurality of random merchant numbers (m i ) for a respective plurality of merchant banks;
determining, with the payment network, the merchant product (M) based on a product of the plurality of random merchant numbers (m i ) for the respective plurality of merchant banks;
generating, with the payment network, a public key (pk i ) based on the second value (g a ), the merchant product (M), and the random merchant number (m i ) and a random key (rk i ) based on the merchant product (M) and the random merchant number (m i ) for each respective merchant bank of the plurality of merchant banks; and
communicating, with the payment network, the public key (pk i ) and the random key (rk i ) to the at least one respective merchant bank.

3. The computer-implemented method of claim 2 , further comprising:
generating, with the at least one respective merchant bank of the plurality of merchant banks, a plurality of random payment gateway numbers (p i ) for a respective plurality of payment gateways; and
generating, with the at least one respective merchant bank of the plurality of merchant banks, a payment gateway public key based on the second value (g a ), the merchant product (M), and the random payment gateway number (p i ) and a payment gateway random key based on the random payment gateway number (p i ) for each respective payment gateway of the plurality of payment gateways.

4. The computer-implemented method of claim 3 , further comprising:
generating, with the at least one respective merchant bank of the plurality of merchant banks, a plurality of terminal numbers (t i ) for a respective plurality of POS terminals; and
generating, with the at least one respective merchant bank of the plurality of merchant banks, the terminal public key based on the second value (g a ), the merchant product (M), the random payment gateway number (p i ), and the terminal number (t i ) and the terminal random key based on the random payment gateway number (p i ) and the terminal number (t i ) for each respective POS terminal of the respective plurality of POS terminals.

5. The computer-implemented method of claim 4 , further comprising:
communicating, with the at least one respective merchant bank of the plurality of merchant banks, the terminal public key and the terminal random key to the at least one payment gateway; and
communicating, with the at least one payment gateway, the terminal public key to the at least one POS terminal.

6. The computer-implemented method of claim 1 , wherein the merchant product (M) comprises a result of multiplication of the plurality of random merchant numbers (m i ).

7. A system comprising:
at least one point-of-sale (POS) terminal including one or more processors, wherein the at least one POS terminal is programmed and/or configured to:
generate a random number (r) for a transaction message (m) associated with a transaction, wherein the transaction message (m) contains sensitive data, and wherein the sensitive data comprises an identification number associated with a user;
generate a first ciphertext associated with the transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with the transaction message (m), the first ciphertext value encrypted based on the random number (r), a generator value (g), and the transaction message (m); and
ii) a second ciphertext value associated with the random number (r), the second ciphertext value encrypted based on the random number (r) and a terminal public key; and

communicate the first ciphertext to at least one payment gateway;

the at least one payment gateway including one or more processors, wherein the at least one payment gateway is programmed and/or configured to:
re-encrypt the second ciphertext value based on a terminal random key to transform the second ciphertext value to a re-encrypted second ciphertext value based on a second value (g a ), a merchant product (M), and the random number (r); and
communicate the re-encrypted second ciphertext value and the first ciphertext value to at least one respective merchant bank of a plurality of merchant banks;

the at least one respective merchant bank of a plurality of merchant banks including one or more processors, wherein the at least one respective merchant bank of the plurality of merchant banks is programmed and/or configured to:
re-encrypt the re-encrypted second ciphertext value to transform the re-encrypted second ciphertext value to a second re-encrypted second ciphertext value; and
communicate the second re-encrypted second ciphertext value and the first ciphertext value to at least one payment network;

the at least one payment network including one or more processors, wherein the at least one payment network is programmed and/or configured to:
decrypt the first ciphertext value to form the transaction message (m) based on the second re-encrypted second ciphertext value, the merchant product (M), the random merchant number (m i ), and the first ciphertext value; and
communicate the transaction message (m) associated with the transaction to at least one

Assignees

• Visa Int Service Ass

Inventors

• Gaddam Sivanarayana
• Watson Gaven James
• Mukherjee Pratyay
• Sinha Rohit

Classifications

• G06Q20/206

  comprising security or operator identification provisions, e.g. password entry · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L63/0471

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title