Data protection with translation

Patent metadata

Field	Value
Publication number	US-12450597-B2
Application number	US-202217665127-A
Country	US
Kind code	B2
Filing date	Feb 4, 2022
Priority date	Jan 5, 2012
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

Systems and methods are disclosed in which data associated with a transaction are protected with encryption. At an access device, a PIN associated with a payment account may be encrypted with a first key derived from an initial key of the access device and sensitive data associated with the payment account may be encrypted with a second key derived from the initial key. At a secure module associated with a host server encrypted sensitive data of an authorization request message may be decrypted. The secure module associated with the host server can re-encrypt the sensitive data using a zone encryption key associated with a payment processing network. A translated authorization request message including the re-encrypted sensitive data can be transmitted by the merchant server to the payment processing network.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, by a payment processing network computer from a host server, an authorization request message for a transaction, wherein the authorization request message includes an encrypted personal identification number (PIN) encrypted using a first zone encryption key and encrypted sensitive data encrypted using a second zone encryption key, wherein the first zone encryption key and the second zone encryption key are associated with the payment processing network computer, unique from each other, and both derived from an initial key derived from a base derivation key that is associated with a key serial number;
decrypting, by the payment processing network computer, the encrypted PIN using a first zone decryption key;
decrypting, by the payment processing network computer, the encrypted sensitive data using a second zone decryption key;
verifying, by the payment processing network computer, the decrypted sensitive data and the decrypted PIN; and
based on the verified decrypted sensitive data and PIN, performing authorization processing for the transaction, including transmitting an authorization response message to the host server, the authorization response message indicating whether the transaction is approved,
wherein the first zone encryption key and the second zone encryption key are selected from a set of zone encryption keys based on a determination that the authorization request message is to be routed to the payment processing network computer, of a plurality of potential payment processing network computers, based on the decrypted sensitive data, and
wherein a third zone encryption key and a fourth zone encryption key are associated with a second payment processing network computer and used for encryption when routing a second authorization request message to the second payment processing network computer, and wherein the second payment processing network computer uses a third zone decryption key and a fourth zone decryption key to decrypt and validate a second sensitive data and a second PIN, respectively, for a second transaction, wherein the host server:
received the sensitive data and the PIN encrypted in a first format, wherein the PIN and the sensitive data are encrypted using Triple DES Encryption Algorithm (TDEA),
derived the initial key from the base derivation key,
generated a first derived decryption key and a second derived decryption key from the initial key according to a derived unique key per transaction (DUKPT) key management scheme,
decrypted the PIN using the first derived decryption key, and
decrypted the sensitive data using the second derived decryption key,
prior to re-encrypting the PIN using the first zone encryption key and re-encrypting the sensitive data using the second zone encryption key.

2. The method of claim 1 , wherein the sensitive data includes a primary account number (PAN) identifying an account.

3. The method of claim 2 , wherein the sensitive data further includes at least one of a cardholder name, a cardholder address, and discretionary data, and wherein a subset of discretionary data remains unencrypted when discretionary data is included in encrypted sensitive data.

4. The method of claim 2 , wherein performing authorization processing for the transaction further comprises:
determining, by the payment processing network computer, whether the transaction is authorized; and
generating, by the payment processing network computer, the authorization response message indicating whether the transaction is authorized.

5. The method of claim 1 , wherein an encrypted primary account number (PAN) is written to a PAN field of the authorization request message, wherein the encrypted PAN has a same format as the PAN.

6. The method of claim 1 , further comprising:
performing, by the payment processing network computer, a clearing and settlement process for the transaction.

7. A payment processing network computer comprising:
a processor; and
a non-transitory computer-readable medium coupled to the processor and comprising instructions executable by the processor to perform steps comprising:
receiving an authorization request message for a transaction from a host server, wherein the authorization request message includes an encrypted personal identification number (PIN) encrypted using a first zone encryption key and encrypted sensitive data encrypted using a second zone encryption key, wherein the first zone encryption key and the second zone encryption key are associated with the payment processing network computer, unique from each other, and both derived from an initial key derived from a base derivation key;
decrypting the encrypted PIN using a first zone decryption key;
decrypting the encrypted sensitive data using a second zone decryption key;
verifying the decrypted sensitive data and the decrypted PIN; and
based on the verified decrypted sensitive data and PIN, performing authorization processing for the transaction, including transmitting an authorization response message to the host server, the authorization response message indicating whether the transaction is approved,
wherein the first zone encryption key and the second zone encryption key are selected from a set of zone encryption keys based on a determination that the authorization request message is to be routed to the payment processing network computer, of a plurality of potential payment processing network computers, based on the decrypted sensitive data, and
wherein a third zone encryption key and a fourth zone encryption key are associated with a second payment processing network computer and used for encryption when routing a second authorization request message to the second payment processing network computer, and wherein the second payment processing network computer uses a third zone decryption key and a fourth zone decryption key to decrypt and validate a second sensitive data and a second PIN, respectively, for a second transaction, wherein the host server:
received the sensitive data and the PIN encrypted in a first format, wherein the PIN and the sensitive data are encrypted using Triple DES Encryption Algorithm (TDEA),
derived the initial key from the base derivation key,
generated a first derived decryption key and a second derived decryption key from the initial key according to a derived unique key per transaction (DUKPT) key management scheme,
decrypted the PIN using the first derived decryption key, and
decrypted the sensitive data using the second derived decryption key,
prior to re-encrypting the PIN using the first zone encryption key and re-encrypting the sensitive data using the second zone encryption key.

8. The payment processing network computer of claim 7 , wherein the sensitive data includes a primary account number (PAN) identifying an account.

9. The payment processing network computer of claim 8 , wherein the sensitive data further includes at least one of a cardholder name, a cardholder address, and discretionary data, and wherein a subset of discretionary data remains unencrypted when discretionary data is included in encrypted sensitive data.

10. The payment processing network computer of claim 7 , wherein performing authorization processing for the transaction further comprises:
determining whether the transaction is authorized.

11. The payment processing network computer of claim 10 , wherein performing authorization processing for the transaction further comprises:
generating the authorization response message based on determining whether the transaction is authorized.

12. The payment processing network computer of claim 7 , wherei

Assignees

• Visa Int Service Ass

Inventors

• Powell Glenn
• Sheets John
• Tait Paul
• Wagner Kim
• Koganti Krishna
• Perl Marc
• Rodriguez Hector
• Zloth Susan

Classifications

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L2463/061

  applying further key derivation, e.g. deriving traffic keys from a pair-wise master key · CPC title

• H04L2463/102

  applying security measure for e-commerce · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title