Master applet for secure remote payment processing

• US 10,592,899 B2
• Filed: 05/13/2015
• Issued: 03/17/2020
• Est. Priority Date: 05/13/2014
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Lingappa, Phaneendra Ramaseshu
• Primary Examiner(s): Coppola, Jacob C.
• Application Number:
  US14/711,615
• Publication Number:
  US 20150332262A1
• Time in Patent Office: 1,770 Days
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/3574 Multiple applications on card
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management

Abstract

Embodiments of the invention are directed to methods, apparatuses, and systems for processing transactions using a master applet on a mobile device. One embodiment of the invention is directed to a method comprising a master applet associated with a mobile application of a mobile device determining available applications on a mobile device, displaying the available applications to a user, and receiving a selection of one of the available applications from the user. The method further comprises obtaining encrypted credentials from the selected application, generating an encrypted payload including the encrypted credentials and transaction data using a master applet encryption key associated with the applet, and sending the encrypted payload to a processor computer. The processor computer decrypts the encrypted payload using a master applet decryption key, decrypts the encrypted credentials using a selected application decryption key, and uses the decrypted credentials and transaction data to initiate a transaction.

Claims

1. A method comprising:

determining, by a master applet associated with a mobile application, a plurality of available applications on a mobile device, each available application of the plurality of available applications having a different application programming interface (API);

displaying, by the master applet, the plurality of available applications to a user;

receiving, by the master applet, a selection of one of the plurality of available applications from the user;

determining, by the master applet, an API for the selected application;

determining, by the master applet, a credential request command based on the API;

sending, by the master applet, the credential request command to the selected application;

obtaining, by the master applet, encrypted credentials from the selected application;

generating, by the master applet, an encrypted payload by encrypting a payload including the encrypted credentials and transaction data, wherein the payload is encrypted using a master applet encryption key associated with the master applet; and

sending the encrypted payload to a processor computer that decrypts the encrypted payload using a master applet decryption key, decrypts the encrypted credentials using a selected application decryption key to obtain decrypted credentials, and uses the decrypted credentials and the transaction data to initiate a transaction.

2. The method of claim 1, wherein each of the plurality of available applications is associated with a different payment method including different user verification processes and different encrypted credentials.

3. The method of claim 1, wherein credentials of the encrypted credentials are encrypted by the selected application using an encryption key associated with the selected application.

4. The method of claim 1, wherein the master applet encryption key and the master applet decryption key are specific to the mobile application and wherein the master applet encryption key and the master applet decryption key are determined using a mobile application identifier associated with the mobile application.

5. The method of claim 1, wherein one of the plurality of available applications includes the master applet, and wherein obtaining encrypted credentials from the selected application comprises:

receiving, by the master applet, credentials from the user; and

encrypting, by the master applet, the credentials using an encryption key associated with the master applet.

6. The method of claim 1, wherein the encrypted payload includes a selected application identifier and wherein the selected application decryption key is determined by the processor computer by searching a registered application key database for the selected application identifier.

7. The method of claim 1, wherein determining the plurality of available applications on the mobile device comprises:

searching, by the master applet, for registered applications present on the mobile device, wherein the registered applications are associated with previously registered application decryption keys stored by the processor computer.

8. The method of claim 1, wherein the encrypted credentials are stored by a remote server computer and the selected application obtains the encrypted credentials from the remote server computer.

9. The method of claim 1, wherein sending the encrypted payload to the processor computer comprises:

sending the encrypted payload and a master applet indicator to a remote computer associated with the mobile application, wherein the remote computer uses the master applet indicator to determine that the encrypted payload should be forwarded to the processor computer, and wherein the remote computer forwards the encrypted payload to the processor computer.

10. The method of claim 1, further comprising:

subsequently, receiving a selection of a second application of the plurality of available applications from the user for a second transaction;

obtaining, by the master applet, second encrypted credentials from the second application; and

generating, by the master applet, a second encrypted payload by encrypting a second payload including the second encrypted credentials and second transaction data, wherein the second payload is encrypted using the master applet encryption key associated with the master applet.

11. A system comprising:

a mobile device comprising a master applet associated with a mobile application, the master applet being configured to;

determine a plurality of available applications on the mobile device, each available application of the plurality of available applications having a different application programming interface (API);

display the plurality of available applications to a user;

receive a selection of one of the plurality of available applications from the user;

determining, by the master applet, an API for the selected application;

determining, by the master applet, a credential request command based on the API;

sending, by the master applet, the credential request command to the selected application;

obtain encrypted credentials from the selected application;

generate an encrypted payload by encrypting a payload including the encrypted credentials, an application identifier, and transaction data, wherein the payload is encrypted using a master applet encryption key, wherein the application identifier indicates that the encrypted credentials were obtained from the selected application; and

send the encrypted payload and an unencrypted indicator to a computer, wherein the unencrypted indicator indicates that the encrypted payload originated from the master applet; and

the computer configured to;

receive the unencrypted indicator and the encrypted payload including the encrypted credentials, the application identifier, and the transaction data;

decrypt the encrypted payload using a decryption key associated with the master applet to obtain the encrypted credentials, the application identifier, and the transaction data;

use the application identifier to search a database for a decryption key associated with the encrypted credentials;

decrypt the encrypted credentials using the decryption key associated with the encrypted credentials; and

initiate a transaction using the decrypted credentials and the transaction data.

12. The system of claim 11, wherein the computer is a processor computer, and wherein the system further comprises:

a mobile application computer associated with the mobile application operating on the mobile device, the mobile application computer being configured to;

receive the encrypted payload and a master applet indicator from the mobile device;

determine that the encrypted payload should be forwarded to the processor computer using the master applet indicator; and

forward the encrypted payload and the master applet indicator to the processor computer.