CLOUD-BASED TRANSACTIONS METHODS AND SYSTEMS

• US 20150180836A1
• Filed: 12/19/2014
• Published: 06/25/2015
• Est. Priority Date: 12/19/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Wong, Erick, Flurscheim, Christian, Makhotin, Oleg, Lopez, Eduardo, Sharma, Sanjeev, Jones, Christopher, Guglani, Abhishek, Sevanto, Jarkko Oskari, Patel, Bharatkumar, Or, Tai Lung Burnnet
• Granted Patent: US 9,972,005 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds

Abstract

Techniques for enhancing the security of a communication device when conducting a transaction using the communication device may include using a limited-use key (LUK) to generate a transaction cryptogram, and sending a token instead of a real account identifier and the transaction cryptogram to an access device to conduct the transaction. The LUK may be associated with a set of one or more limited-use thresholds that limits usage of the LUK, and the transaction can be authorized based on at least whether usage of the LUK has exceeded the set of one or more limited-use thresholds.

Claims

1. A method for enhancing security of a communication device when conducting a transaction using the communication device, the method comprising:

receiving, from a remote computer, a limited-use key (LUK) that is associated with a set of one or more limited-use thresholds that limits usage of the LUK;

generating, by the communication device, a transaction cryptogram using the LUK; and

sending, to an access device, a token instead of a real account identifier and the transaction cryptogram to conduct the transaction, wherein the transaction is authorized based on at least whether usage of the LUK has exceeded the set of one or more limited-use thresholds.

2. The method of claim 1, wherein the communication device does not store the LUK or the token in a secure element.

3. The method of claim 1, wherein receiving the LUK further includes receiving a key index that includes information pertaining to generation of the LUK.

4. The method of claim 3, wherein the key index is sent with the transaction cryptogram to the access device to conduct the transaction.

5. The method of claim 3, wherein the key index includes at least one of:

time information indicating when the LUK is generated; and

a replenishment counter value indicating a number of times the LUK has been replenished.

6. The method of claim 3, wherein the key index includes:

a pseudo-random number that is used as a seed to generate the LUK;

or

a transaction counter value indicating a number of transactions that has been previously conducted by a mobile application of the communication device at the time the LUK is generated.

7. The method of claim 1, wherein the set of one or more limited-use thresholds includes at least one of:

a time-to-live indicating a time duration that the LUK is valid for;

a predetermined number of transactions that the LUK is valid for; and

a cumulative transaction amount indicating the total transaction amount that the LUK is valid for.

8. The method of claim 1, wherein the set of one or more limited-use thresholds includes an international usage threshold and a domestic usage threshold.

9. The method of claim 1, wherein the LUK is a first LUK, and the method further comprises:

sending, to the remote computer, a replenishment request for a second LUK, the replenishment request including transaction log information derived from a transaction log stored on the communication device; and

receiving, from the remote computer, the second LUK when the transaction log information in the replenishment request matches transaction log information at the remote computer.

10. The method of claim 9, wherein the transaction log stored on the communication device includes:

for each transaction conducted using the LUK;

a transaction timestamp indicating the time of the corresponding transaction;

an application transaction counter value associated with the corresponding transaction; and

a transaction type indicator indicating whether the corresponding transaction is a magnetic stripe based transaction or an integrated chip based transaction.

11. The method of claim 9, wherein the transaction log information sent to the remote computer includes an authentication code computed over at least the transaction log using the LUK.

12. The method of claim 9, wherein the replenishment request is sent in response to:

determining that a next transaction conducted with the LUK will exhaust the set of one or more limited-use thresholds;

determining that the set of one or more limited-use thresholds associated with the LUK has been exhausted;

or

receiving a push message requesting the communication device to replenish the LUK.

13. A communication device comprising:

a processor; and

a memory coupled to the processor and storing a mobile application that performs operations for enhancing security of the communication device when conducting transactions using the communication device, the operations including;

receiving a limited-use key (LUK) that is associated with a set of one or more limited-use thresholds that limits usage of the LUK;

generating a transaction cryptogram using the LUK; and

sending a token instead of a real account identifier and the transaction cryptogram to an access device to conduct the transaction, wherein the transaction is authorized based on at least whether usage of the LUK has exceeded the set of one or more limited-use thresholds.

14. The communication device of claim 13, wherein the communication device does not store the LUK or the token in a secure element.

15. The communication device of claim 13, wherein receiving the LUK further includes receiving a key index that includes information pertaining to generation of the LUK.

16. The communication device of claim 15, wherein the key index is sent with the transaction cryptogram to the access device to conduct the transaction.

17. The communication device of claim 15, wherein the key index includes at least one of:

time information indicating when the LUK is generated; and

a replenishment counter value indicating a number of times the LUK has been replenished.

18. The communication device of claim 15, wherein the key index includes a seed from which the LUK is generated.

19. The communication device of claim 13, wherein the set of one or more limited-use thresholds includes at least one of:

a time-to-live indicating a time duration that the LUK is valid for;

a predetermined number of transactions that the LUK is valid for; and

a cumulative transaction amount indicating the total transaction amount that the LUK is valid for.

20. The communication device of claim 13, wherein the set of one or more limited-use thresholds includes an international usage threshold and a domestic usage threshold.

21. The communication device of claim 13, wherein the LUK is a first LUK, and the operations further include:

sending, to the remote computer, a replenishment request for a second LUK, the replenishment request including transaction log information derived from a transaction log stored on the communication device; and

receiving, from the remote computer, the second LUK when the transaction log information in the replenishment request matches transaction log information at the remote computer.

22. The communication device of claim 21, wherein the transaction log stored on the communication device includes:

for each transaction conducted using the LUK;

a transaction timestamp indicating the time of the corresponding transaction;

an application transaction counter value associated with the corresponding transaction; and

a transaction type indicator indicating whether the corresponding transaction is a magnetic stripe based transaction or an integrated chip based transaction.

23. The communication device of claim 21, wherein the transaction log information sent to the remote computer includes an authentication code computed over at least the transaction log using the LUK.

24. The communication device of claim 21, wherein the replenishment request is sent in response to:

determining that a next transaction conducted with the LUK will exhaust the set of one or more limited-use thresholds;

determining that the set of one or more limited-use thresholds associated with the LUK has been exhausted;

or

receiving a push message requesting the communication device to replenish the LUK.