Unique token authentication cryptogram

• US 10,361,856 B2
• Filed: 06/23/2017
• Issued: 07/23/2019
• Est. Priority Date: 06/24/2016
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Cassin, Michael, Flurscheim, Christian, Jones, Christopher
• Primary Examiner(s): Dada, Beemnet W
• Application Number:
  US15/632,223
• Publication Number:
  US 20170373852A1
• Time in Patent Office: 760 Days
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/14 specially adapted for billing systems
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

Embodiments of the invention are directed to systems and methods for validating transactions using a cryptogram. One embodiment of the invention is directed to a method of processing a remote transaction initiated by a communication device provisioned with a token. The method comprises receiving, by a service provider computer, from an application on the communication device, a request for a token authentication cryptogram, wherein the token authentication cryptogram includes encrypted user exclusive data. The service provider computer may generate the token authentication cryptogram to include the user exclusive data. The service provider computer may send the token authentication cryptogram to the application, where the token authentication cryptogram can be used to validate the transaction, and the user exclusive data is extracted from the token authentication cryptogram during validation.

Claims

1. A method of processing a transaction initiated by a communication device provisioned with a token, the method comprising:

receiving, by a service provider computer, from an application operating on the communication device, a token request message for a token authentication cryptogram;

generating, by the service provider computer, the token authentication cryptogram derived from user exclusive data, wherein the token authentication cryptogram is generated by encrypting at least the user exclusive data utilizing a triple data encryption algorithm; and

sending, by the service provider computer to the application, the token authentication cryptogram, wherein the token authentication cryptogram can be used to validate the transaction, and the user exclusive data subsequently is extracted from the token authentication cryptogram during validation by a processing computer which then uses the user exclusive data for additional analysis.

2. The method of claim 1, wherein the user exclusive data comprises at least one of:

a resource provider identifier, user preference information, or a user identifier.

3. The method of claim 1, wherein the token authentication cryptogram is sent to the application utilizing a token response message.

4. The method of claim 1, wherein the application is hosted by a resource provider computer.

5. The method of claim 1, wherein receipt of the token authentication cryptogram causes the application to transmit the token authentication cryptogram in an authorization request message to a transaction processing computer.

6. The method of claim 1, wherein content of the user exclusive data is specified by the service provider computer.

18. The method of claim 1, wherein the token authentication cryptogram further encrypts the token and a transaction type indicator.

19. The method of claim 1, further comprising:

receiving, by the processing computer, an authorization request message comprising the token and the token authentication cryptogram;

extracting, by the processing computer, the user exclusive data; and

performing, by the processing computer, the additional analysis on the user exclusive data.

20. The method of claim 1, wherein the additional analysis comprises performing a fraud analysis on the user exclusive data.

7. A method of processing a transaction initiated by a communication device, the method comprising:

sending, by a service provider computer, to a token provider computer, a token request message for a token authentication cryptogram, wherein the token request message comprises user exclusive data;

receiving, by the service provider computer, from the token provider computer, a token and the token authentication cryptogram, the token authentication cryptogram derived from the user exclusive data, wherein the token authentication cryptogram is generated by encrypting at least the user exclusive data utilizing a triple data encryption algorithm; and

sending, by the service provider computer to the communication device, the token and the token authentication cryptogram, wherein the token authentication cryptogram can be used to validate the transaction, and the user exclusive data is subsequently extracted from the token authentication cryptogram during validation by a processing computer which then uses the user exclusive data for additional analysis.

8. The method of claim 7, wherein the user exclusive data comprises at least one of:

a resource provider identifier, user preference information, or a user identifier.

9. The method of claim 7, wherein the token and the token authentication cryptogram is sent to the communication device utilizing a token response message.

10. The method of claim 7, wherein the token and the token authentication cryptogram is sent to an application operating on the communication device.

11. The method of claim 10, wherein the application is hosted by a resource provider computer.

12. The method of claim 11, wherein receipt of the token authentication cryptogram causes the application to transmit the token authentication cryptogram in an authorization request message to a transaction processing computer.

13. The method of claim 7, wherein content of the user exclusive data is specified by the service provider computer.

14. A service provider computer comprising,

a processor, and

a computer readable medium coupled to the processor, the computer readable medium comprising code for causing the processor to perform operations comprising:

sending, to a server computer, a request for a token authentication cryptogram, wherein the request comprises user exclusive data;

receiving, from the server computer, a token and the token authentication cryptogram derived from the user exclusive data, wherein the token authentication cryptogram is generated by encrypting at least the user exclusive data utilizing a triple data encryption algorithm; and

sending, to an application operating on a user device, the token and the token authentication cryptogram with transaction data, wherein the token authentication cryptogram can be used to validate the transaction data, and the user exclusive data is subsequently extracted from the token authentication cryptogram during validation by a processing computer when then uses the user exclusive data for additional analysis.

15. The service provider computer of claim 14, wherein the user exclusive data comprises at least one of:

a resource provider identifier, user preference information, or a user identifier.

16. The service provider computer of claim 14, wherein the token authentication cryptogram is requested utilizing a token request message.

17. The service provider computer of claim 14, wherein the token authentication cryptogram is sent to the application in a token response message.