Payment system

Patent metadata

Field	Value
Publication number	US-12327244-B2
Application number	US-202418639887-A
Country	US
Kind code	B2
Filing date	Apr 18, 2024
Priority date	Apr 5, 2011
Publication date	Jun 10, 2025
Grant date	Jun 10, 2025

Abstract

A method is disclosed. The method includes receiving a first session key different from a Master Key from a remote entity, the first session key based on the Master Key. The first session key is usable for a limited number of transactions. In response to receiving the first session key, the method includes provisioning a payment application in the user device with the first session key. The method includes receiving, at the payment application, a request for an application cryptogram from a point-of-sale terminal. In response to the receiving the request for the application cryptogram, the method includes generating the application cryptogram using the first session key, transmitting the application cryptogram to the point-of-sale terminal, and receiving a second session key from the remote entity. The second session key is based on the Master Key.

First claim

What is claimed is:

1. A user device for conducting a payment transaction with a point-of-sale terminal, the user device comprising a payment application, and wherein the payment application received a session key from a remote entity, the session key being different from a Master Key, and the session key generated using the Master Key, whereby the user device comprises code executable by a processor in the user device, to perform an authorization process, the authorization process comprising the steps of:
receiving a request for an application cryptogram;
generating the application cryptogram using the received session key; and transmitting the generated application cryptogram to the point-of-sale terminal, wherein the application cryptogram is subsequently verified and the payment transaction is authorized.

2. The user device according to claim 1 comprising:
a first processing portion; and
a second processing portion,
wherein the first processing portion comprises a first application environment within a secure element and the second processing portion comprises a second application environment external to the secure element, wherein the second processing portion comprises the payment application.

3. A method comprising:
receiving, by a user device via a communication network, a first session key different from a Master Key from a remote entity, the first session key based on the Master Key stored at the remote entity, wherein the first session key is usable for a limited number of one or more transactions;
in response to receiving the first session key, storing the first session key;
in response to storing the first session key, provisioning a payment application in the user device with the first session key;
receiving, at the payment application, a request for an application cryptogram, wherein the request is from a point-of-sale terminal;
in response to the receiving the request for the application cryptogram, generating, by the payment application, the application cryptogram using the received first session key;
transmitting, by the payment application, the generated application cryptogram to the point-of-sale terminal;
receiving, by the user device via the communication network, a second session key from the remote entity, the second session key based on the Master Key stored at the remote entity, the second session key being different from the first session key and the Master Key; and
storing, by the user device, the second session key.

4. The method of claim 3 , wherein the user device is a mobile phone.

5. The method of claim 3 , wherein a payment transaction conducted using the first session key is denied in response to an amount of time between provisioning of the first session key and the payment transaction exceeding a threshold amount of time.

6. A user device comprising:
a processor; and
a non-transitory computer readable medium comprising code, executable by the processor, for implementing operations including:
receiving, by the user device via a communication network, a first session key different from a Master Key from a remote entity, the first session key based on the Master Key stored at the remote entity, wherein the first session key is usable for a limited number of one or more transactions;
in response to receiving the first session key, storing the first session key;
in response to storing the first session key, provisioning a payment application in the user device with the first session key;
receiving, at the payment application, a request for an application cryptogram, wherein the request is from a point-of-sale terminal;
in response to the receiving the request for the application cryptogram, generating, by the payment application, the application cryptogram based on the received first session key;
transmitting, by the payment application, the generated application cryptogram to the point-of-sale terminal;
receiving, by the user device via the communication network, a second session key from the remote entity, the second session key based on the Master Key stored at the remote entity, the second session key being different from the first session key and the Master Key; and
storing, by the user device, the second session key.

7. The user device of claim 6 , wherein the operations further comprise:
discarding, by the user device, the first session key after generating the application cryptogram.

8. The user device of claim 6 , wherein the operations further comprise:
provisioning the second session key to the payment application in response to a predetermined criterion being satisfied.

9. The user device of claim 8 , wherein the predetermined criterion is based on a predetermined amount of time having elapsed since the provisioning of the first session key to the user device.

10. The user device of claim 8 , wherein the predetermined criterion comprises a number of session keys stored by the user device falling below a predetermined value.

11. The user device of claim 6 , wherein the user device is a mobile communications device.

12. The user device of claim 6 , wherein the operations further comprise one or more of:
storing the first session key in a Trusted Execution Environment;
storing at least part of the payment application in the Trusted Execution Environment; or
executing at least part of the payment application in the Trusted Execution Environment.

13. The user device of claim 6 , wherein the transmitting of the generated application cryptogram comprises using a radio frequency communications protocol.

14. The user device of claim 6 , wherein the first session key is valid only for a single payment transaction.

15. The user device of claim 6 , therein the operations further comprise:
storing, by the user device, a plurality of session keys including the first session key, the second session key, and a third session key sent from the remote entity.

16. The user device of claim 15 , wherein the plurality of session keys are stored encrypted in the user device, the encrypted session keys including an encrypted first session key.

17. The user device of claim 16 , wherein the operations comprise:
decrypting the encrypted first session key.

18. The user device of claim 17 , wherein the operations further comprise:
receiving, by the user device, user input; and
decrypting, by the user device, one of the plurality of session keys using the user input as a decryption key.

19. The user device of claim 6 , wherein the operations further comprise:
periodically receiving, by the user device, new session keys from the remote entity.

20. The user device of claim 6 , wherein the Master Key is an ICC Master Key.

Assignees

• Visa Europe Ltd

Inventors

• Fiske Stuart

Classifications

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• G06Q20/322

  Aspects of commerce using mobile devices [M-devices] · CPC title

• G07F7/127

  in which both online and offline card verification can take place · CPC title