Limited-use keys and cryptograms

Patent metadata

Field	Value
Publication number	US-12469021-B2
Application number	US-202117489227-A
Country	US
Kind code	B2
Filing date	Sep 29, 2021
Priority date	Feb 18, 2014
Publication date	Nov 11, 2025
Grant date	Nov 11, 2025

Abstract

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include encrypting account information with a first encryption key to generate a second encryption key, and encrypting key index information using the second key to generate a limited-use key (LUK). The key index information may include a key index having information pertaining to generation of the LUK. The LUK and the key index can be provided to the communication device to facilitate generation of a transaction cryptogram for a transaction conducted using the communication device, and the transaction can be authorized based on the transaction cryptogram generated from the LUK.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a communication device from a computer system, a limited-use key (LUK) that is associated with one or more limited-use thresholds that limits usage of the LUK; receiving, by the communication device from the computer system, a key index with the LUK, the key index including a counter value indicating a number of times that the LUK has been renewed in a predetermined time period and time information indicating when the LUK was generated, and wherein the computer system encrypts account information with a first encryption key to generate a second encryption key, and encrypts the key index with the second encryption key to generate the LUK; receiving, by the communication device from an access device, transaction data for a transaction; generating, by the communication device, a transaction cryptogram for the transaction by encrypting the transaction data with the LUK; and sending, by the communication device, the transaction cryptogram and the key index to the access device to conduct the transaction, thereby causing the access device to provide the transaction cryptogram and the key index to the computer system via an authorization request message, and causing the computer system to verify that the transaction cryptogram was encrypted using the LUK by regenerating the transaction cryptogram using the key index, verify that the LUK has not exceeded the one or more limited-use thresholds, and authorize the transaction based on the verification of the transaction cryptogram and further based on the verification that the LUK has not exceeded the one or more limited-use thresholds.

2 . The method of claim 1 , wherein the account information includes an account identifier or a token that is a substitute for the account identifier.

3 . The method of claim 1 , wherein the account information includes a token that is a substitute for an account identifier, and further comprising:
sending, by the communication device, the token to the access device along with the transaction cryptogram and the key index, wherein the access device provides the token to the computer system via the authorization request message, and wherein the computer system authorizes the transaction further based on the token.

4 . The method of claim 1 , wherein generating the transaction cryptogram includes:
enciphering the transaction data using a first portion of the LUK; deciphering the enciphered transaction data using a second portion of the LUK; and re-enciphering the deciphered transaction data using the first portion of the LUK.

5 . The method of claim 1 , wherein generating the transaction cryptogram takes place when the communication device is placed in proximity to the access device, and wherein sending the transaction cryptogram and the key index to the access device is performed by transmitting the transaction cryptogram and the key index to a contactless reader of the access device.

6 . The method of claim 1 , wherein sending the transaction cryptogram and the key index to the access device includes displaying a QR code a screen of the communication device for scanning by the access device, where the transaction cryptogram and the key index are encoded into the QR code.

7 . The method of claim 1 , further comprising:
sending, by the communication device to the access device, a request for the transaction data.

8 . The method of claim 1 , wherein the transaction is conducted without using a secure element.

9 . The method of claim 1 , wherein generating the transaction cryptogram includes:
encrypting a predetermined numeric string using the LUK; and decimalizing the encrypted predetermined numeric string.

10 . The method of claim 9 , wherein decimalizing the encrypted predetermined numeric string includes:
extracting numeric digits from the encrypted predetermined numeric string to form a first data block; extracting hexadecimal digits from the encrypted predetermined numeric string and converting each extracted hexadecimal digit into a numeric digit to form a second data block; and concatenating the first data block and the second data block.

11 . A system comprising:
a computer system comprising:
one or more first processors; and
one or more first memories storing computer-readable code, which when executed by the one or more first processors, causes the computer system to perform first operations including:
encrypting account information with a first encryption key to generate a second encryption key;
encrypting a key index using the second encryption key to generate a limited-use key (LUK), wherein the key index includes a counter value indicating a number of times that the LUK has been renewed in a predetermined time period, and time information indicating when the LUK is generated, and wherein the LUK is associated with one or more limited-use thresholds that limits usage of the LUK;
providing the LUK and the key index to a communication device;
receiving the key index and a transaction cryptogram;
verifying that the transaction cryptogram was encrypted using the LUK and that the LUK has not exceeded the one or more limited-use thresholds, wherein verifying that the transaction cryptogram was encrypted using the LUK includes:
regenerating the transaction cryptogram using the received key index; and

based on the verifying, authorizing a transaction; and

the communication device comprising:
one or more second processors; and
one or more second memories storing computer-readable code, which when executed by the one or more second processors, causes the communication device to perform second operations including:
receiving, from the computer system, the LUK,
receiving, from the computer system, the key index with the LUK;
receiving, from an access device, transaction data for the transaction;
generating the transaction cryptogram for the transaction by encrypting the transaction data with the LUK; and
sending, to the computer system, the transaction cryptogram and the key index to the access device to conduct the transaction, wherein the access device provides the transaction cryptogram and the key index to the computer system via an authorization request message.

12 . The system of claim 11 , wherein the verifying that the transaction cryptogram was encrypted using the LUK includes comparing the regenerated transaction cryptogram to the received transaction cryptogram.

13 . The system of claim 11 , wherein the transaction is conducted without using a secure element.

14 . The system of claim 11 , wherein the one or more limited-use thresholds limits a number of transactions that can be conducted using the LUK.

15 . The system of claim 11 , wherein the first encryption key is a master derivation key associated with an issuer of an account associated with the account information.

16 . The system of claim 15 , wherein the second encryption key is a unique derivation key for the account.

17 . The system of claim 11 , wherein the first operations further include:
sending an authorization response message with authorization response results to the access device, and wherein the access device displays the authorization response results.

18 . The system of claim 11 , wherein encrypting the account information with the first encryption key to generate the second encryption key includes encrypting the account information using the first encryption key to generate a first portion of the second encryption key, inverting the account information, and encr

Assignees

• Visa Int Service Ass

Inventors

• Ngo Hao
• Aabye Christian
• Sheets John
• Makhotin Oleg

Classifications

• G06Q2220/00

  Business processing using cryptography · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• G06Q20/385

  using an alias or single-use codes · CPC title