LIMITED-USE KEYS AND CRYPTOGRAMS

• US 20150178724A1
• Filed: 12/19/2014
• Published: 06/25/2015
• Est. Priority Date: 12/19/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Ngo, Hao, Aabye, Christian, Sheets, John, Makhotin, Oleg
• Granted Patent: US 11,164,176 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include encrypting account information with a first encryption key to generate a second encryption key, and encrypting key index information using the second key to generate a limited-use key (LUK). The key index information may include a key index having information pertaining to generation of the LUK. The LUK and the key index can be provided to the communication device to facilitate generation of a transaction cryptogram for a transaction conducted using the communication device, and the transaction can be authorized based on the transaction cryptogram generated from the LUK.

Claims

1. A method for enhancing security of a communication device when conducting a transaction using the communication device, the method comprising:

encrypting, by a computer, account information with a first encryption key to generate a second encryption key;

encrypting key index information using the second encryption key to generate a limited-use key (LUK), wherein the key index information includes a key index having information pertaining to generation of the LUK; and

providing the LUK and the key index to the communication device to facilitate generation of a transaction cryptogram for the transaction conducted using the communication device, wherein the transaction is authorized based on the transaction cryptogram generated from the LUK.

2. The method of claim 1, wherein the key index information includes a counter value indicating a number of times that the LUK has been renewed in a predetermined time period.

3. The method of claim 1, wherein the key index information includes time information indicating when the LUK is generated.

4. The method of claim 1, wherein the LUK is associated with a set of one or more limited-use thresholds to limit the number of transactions that can be conducted using the LUK.

5. The method of claim 1, wherein the account information includes a token that is a substitute for an account identifier.

6. The method of claim 1, wherein the first encryption key is a master derivation key associated with an issuer of an account associated with the account information.

7. The method of claim 6, wherein the second encryption key is a unique derivation key for the account.

8. The method of claim 1, wherein encrypting the account information with the first encryption key to generate the second encryption key includes:

encrypting the account information using the first encryption key to generate a first portion of the second encryption key;

inverting the account information; and

encrypting the inverted account information using the first encryption key to generate a second portion of the second encryption key.

9. The method of claim 1, wherein encrypting the key index information using the second encryption key to generate the LUK includes:

padding the key index with a first value to generate a first padded key index information;

encrypting the first padded key index information to generate a first portion of the LUK;

padding the key index with a second value to generate a second padded key index information; and

encrypting the second padded key index information to generate a second portion of the LUK.

10. The method of claim 1, wherein the transaction cryptogram is generated by:

enciphering transaction information using a first portion of the LUK;

deciphering the enciphered transaction information using a second portion of the LUK; and

re-enciphering the deciphered transaction information using the first portion of the LUK.

11. The method of claim 1, wherein the transaction cryptogram is generated by:

encrypting a predetermined numeric string using the LUK; and

decimalizing the encrypted predetermined numeric string.

12. The method of claim 11, wherein decimalizing the encrypted predetermined numeric string includes:

extracting numeric digits from the encrypted predetermined numeric string to form a first data block;

extracting hexadecimal digits from the encrypted predetermined numeric string and converting each extracted hexadecimal digit into a numeric digit to form a second data block; and

concatenating the first data block and the second data block.

13. A computer for enhancing security of a communication device when conducting transactions using the communication device, the computer comprising:

a processor; and

a memory storing computer-readable code, which when executed by the processor, causes the computer to perform operations including;

encrypting account information with a first encryption key to generate a second encryption key;

encrypting key index information using the second encryption key to generate a limited-use key (LUK), wherein the key index information includes a key index having information pertaining to generation of the LUK; and

providing the LUK and the key index to the communication device to facilitate generation of a transaction cryptogram for the transaction conducted using the communication device, wherein the transaction is authorized based on the transaction cryptogram generated from the LUK.

14. The computer of claim 13, wherein the key index information includes a counter value indicating a number of times that the LUK has been renewed in a predetermined time period.

15. The computer of claim 13, wherein the key index information includes time information indicating when the LUK is generated.

16. The computer of claim 13, wherein the LUK is associated with a set of one or more limited-use thresholds to limit the number of transactions that can be conducted using the LUK.

17. The computer of claim 13, wherein the account information includes a token that is a substitute for an account identifier.

18. The computer of claim 13, wherein the first encryption key is a master derivation key associated with an issuer of an account associated with the account information.

19. The computer of claim 13, wherein the second encryption key is a unique derivation key for the account.

20. The computer of claim 13, wherein encrypting the account information with the first encryption key to generate the second encryption key includes:

encrypting the account information using the first encryption key to generate a first portion of the second encryption key;

inverting the account information; and

encrypting the inverted account information using the first encryption key to generate a second portion of the second encryption key.

21. The computer of claim 13, wherein encrypting the key index information using the second encryption key to generate the LUK includes:

padding the key index with a first value to generate a first padded key index information;

encrypting the first padded key index information to generate a first portion of the LUK;

padding the key index with a second value to generate a second padded key index information; and

encrypting the second padded key index information to generate a second portion of the LUK.

22. The computer of claim 13, wherein the transaction cryptogram is generated by:

enciphering transaction information using a first portion of the LUK;

deciphering the enciphered transaction information using a second portion of the LUK; and

re-enciphering the deciphered transaction information using the first portion of the LUK.

23. The computer of claim 13, wherein the transaction cryptogram is generated by:

encrypting a predetermined numeric string using the LUK; and

decimalizing the encrypted predetermined numeric string.

24. The computer of claim 23, wherein decimalizing the encrypted predetermined numeric string includes:

extracting numeric digits from the encrypted predetermined numeric string to form a first data block;

extracting hexadecimal digits from the encrypted predetermined numeric string and converting each extracted hexadecimal digit into a numeric digit to form a second data block; and

concatenating the first data block and the second data block.