Token generating component

• US 10,304,047 B2
• Filed: 12/06/2013
• Issued: 05/28/2019
• Est. Priority Date: 12/07/2012
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Huxham, Horatio Nelson, O'Regan, Alan Joseph, Van Wyk, Hough Arie, Moss, Tara Anne
• Primary Examiner(s): Chang, Edward
• Assistant Examiner(s): Smith, Slade E
• Application Number:
  US14/648,510
• Publication Number:
  US 20150302390A1
• Time in Patent Office: 1,999 Days
• Field of Search: 705 67
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06Q 20/3229 Use of the SIM of a M-device as secure element
• CPC Class Codes: G06Q 20/327 Short range or proximity payments by means of M-devices
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/40 Security arrangements using identity modules

Abstract

The invention provides a method and system for providing financial details from a mobile device of a user for use in a transaction. The method is performed on a mobile device of the user and includes the steps of generating, on a token generating component, a session-specific token by applying an algorithm requiring a dynamic key; providing financial details for use in a transaction; incorporating the session-specific token and the financial details into a modified form the financial details; and transferring the modified form of the financial details from the mobile device to initiate the transaction. A corresponding method and system for validating financial details received, at a server of an issuing authority, is also provided.

Claims

1. A method for providing financial details from a mobile device of a user for use in a transaction, the method being performed on the mobile device of the user and including the steps of:

generating, on a token generating component associated with the mobile device, a session-specific token by applying an algorithm stored on the token generating component with a dynamic key, the session-specific token generated by encrypting a customer identification number using the dynamic key and a seed value unique to the user;

retrieving, by the mobile device, financial details in a pre-determined format conforming to Track 2 data format for use in a transaction;

incorporating the session-specific token and the financial details into a modified form of the financial details including encrypting a portion of characters of the financial details using the session-specific token by incorporating a first portion of the session-specific token before a check digit of the financial details, incorporating a second portion of the session-specific token before a CVV field of the financial details, and replacing data in an account number field with the customer identification number; and

transferring the modified form of the financial details in the predetermined format from the mobile device to an issuing authority to initiate the transaction, the issuing authority validating the session-specific token within the modified form of the financial details before authorizing the transaction.

2. The method as claimed in claim 1, wherein incorporating the session-specific token and the financial details into a modified form of the financial details includes:

inserting the session-specific token into redundant characters in the pre-determined format.

3. The method as claimed in claim 1, wherein the seed value unique to the user is provided by the issuing authority to the mobile device.

4. The method as claimed in claim 1, wherein the seed value unique to the user is used by the issuing authority to generate an expected session-specific token, the expected session-specific token being compared to the session-specific token when validating the session-specific token.

5. The method as claimed in claim 1, wherein the session-specific token offline from an is generated while not in communication with the issuing authority and the dynamic key is coordinated between the mobile device and the issuing authority.

6. The method as claimed in claim 5, wherein the dynamic key and one of a customer identifier or an initialization vector for a customer is used by an issuing authority to generate an expected-session-specific token to be compared to the session-specific token to authenticate the user.

7. The method as claimed in claim 1, wherein the financial details include static customer account details or one-time generated customer account details.

8. The method as claimed in claim 1, wherein the dynamic key is randomly selected from a pre-calculated set of keys;

and a key serial number related to the dynamic key is transferred along with the modified form of the financial details, wherein the key serial number is able to be used to determine the dynamic key that was used.

9. The method as claimed in claim 1, wherein the dynamic key is a counter value which increments or changes every time the algorithm is applied.

10. The method as claimed in claim 1, wherein the dynamic key is based on a time signal derived by the mobile device, the time signal indicating a time at which the generation of the session-specific token is carried out.

11. The method as claimed in claim 1, wherein the token generating component is a cryptographic expansion device that can be attached to a communication component of the mobile device;

and the cryptographic expansion device is configured to be used with the mobile device without requiring any changes to the internal software or hardware of the mobile device and without requiring any modification to the communication protocols used by the mobile device.

12. The method as claimed in claim 1, wherein the token generating component is a hardware security module which uses hardware to generate the session-specific token.

13. The method as claimed in claim 1, wherein validating the session-specific token by the issuing authority comprises:

identifying, by the issuing authority, the seed value unique to the user based on the customer identification number;

determining a lifetime of the session-specific token;

generating a plurality of expected session-specific tokens based on the lifetime of the session-specific token; and

comparing the session-specific token to each of the expected session-specific tokens of the plurality of expected session-specific tokens, the session-specific token being validated upon determining that the session-specific token matches one expected session-specific token of the plurality of expected session-specific tokens.

14. The method as claimed in claim 13, wherein the lifetime of the session-specific token is ten minutes and the plurality of expected session-specific tokens comprises ten expected session-specific tokens, wherein each of the plurality of expected session-specific tokens is generated to correspond to a one-minute interval of the lifetime.

15. The method as claimed in claim 1, wherein the session-specific token comprises six digits, the first portion of the session-specific token comprises a first three digits of the session-specific token, and the second portion of the session-specific token comprises a last three digits of the session-specific token.

16. A system for providing financial details from a mobile device of a user for use in a transaction, the system being provided on the mobile device of the user and including:

a token generating component associated with the mobile device for generating a session-specific token by applying an algorithm stored on the token generating component with a dynamic key, the session-specific token generated by encrypting a customer identification number using the dynamic key and a seed value unique to the user;

a financial details component for providing financial details in a pre-determined format conforming to Track 2 data format for use in a transaction;

a format modifying component for incorporating the session-specific token and the financial details into a modified form of the financial details including encrypting a portion of characters of the financial details with the session-specific token by incorporating a first portion of the session-specific token before a check digit of the financial details, incorporating a second portion of the session-specific token before a CVV field of the financial details, and replacing data in an account number field with the customer identification number; and

a communication component for transferring the modified form of the financial details in the pre-determined format from the mobile device to an issuing authority to initiate the transaction, the issuing authority being caused to validate the session-specific token within the modified form of the financial details before authorizing the transaction.

17. The system as claimed in claim 16, wherein the token generating component is a cryptographic expansion device that can be attached to a communication component of the mobile device;

and the cryptographic expansion device is configured to be used with the mobile device without requiring any changes to the internal software or hardware of the mobile device and without requiring any modification to the communication protocols used by the mobile device.

18. The system as claimed in claim 17, wherein the cryptographic expansion device is a cryptographic label that includes a hardware security module (HSM) disposed therein including a secure processing unit and a public processing unit.

19. The system as claimed in claim 16, wherein the token generating component is a hardware security module which uses hardware to generate the session-specific token.

20. A computer program product for providing financial details from a mobile device of a user for use in a transaction, the computer program product comprising a computer-readable medium having stored computer-readable program code for performing the steps of:

generating, on a token generating component associated with the mobile device, a session-specific token by applying an algorithm stored on the token generating component with a dynamic key, the session-specific token generated by encrypting a customer identification number using the dynamic key and a seed value unique to the user;

providing financial details in a pre-determined format conforming to Track 2 data format for use in a transaction;

incorporating the session-specific token and the financial details into a modified form of the financial details including encrypting a portion of characters of the financial details with the session-specific token by incorporating a first portion of the session-specific token before a check digit of the financial details, incorporating a second portion of the session-specific token before a CVV field of the financial details, and replacing data in an account number field with the customer identification number; and

transferring the modified form of the financial details in the predetermined format from the mobile device to an issuing authority to initiate the transaction, the issuing authority validating the session-specific token within the modified form of the financial details before authorizing the transaction.