Abstract:
A method for generating transaction credentials for a user in a transaction, comprising: storing in a mobile device, an encrypted session key, and an encrypted user authentication credential; receiving an authorisation request; initiating a user authorisation process wherein in the event that the user is an authenticated user, the method comprises: decrypting the encrypted session key and encrypted user authentication credential; generating a transaction cryptogram in dependence on the user authentication credential and the session key; transmitting the transaction cryptogram and a user authentication status to a transaction processing entity for use in a transaction.
Abstract:
A method for verifying the source of an authorization request includes: storing an integrated circuit card (ICC) master key; receiving an authorization request for a transaction, wherein the request includes an ICC dynamic number, and the ICC dynamic number is extracted from signed data, based on the ICC master key, generated by a payment card during combined data authentication (CDA); verifying the authenticity of the ICC dynamic number using the stored ICC master key; and transmitting the authorization request to a third party. A method for transmitting an authentic authorization request includes: storing payment card data, the data including an ICC master key associated with the payment card; authenticating the card data using CDA to generate signed data; extracting, from the signed data, an ICC dynamic number based on the ICC master key; and transmitting an authorization request for a transaction, the request including the extracted ICC dynamic number.
Abstract:
A method for a goods authentication infrastructure to authenticate goods associated with a unique identifier is provided. The method comprises associating a tokenised identifier for the goods with the unique identifier of the goods; and providing the tokenised identifier and cryptographic elements to an authentication device associated with the owner of the goods. The cryptographic elements can be used by the authentication device to generate a message with a digital authentication code and the digital authentication code can be used by a computing device receiving the message to verify the content of the message. A single tokenised identifier is associated with the unique identifier of the goods at any one time. A method for authenticating goods using an authentication device is also provided, as is an authentication device configured to perform the method.
Abstract:
Systems and methods are provided for authenticating users to payment accounts in connection with transactions. An exemplary method includes receiving, by at least one computing device, an authentication request for a transaction associated with a payment account where the authentication request includes a token associated with the payment account and a cryptogram, and mapping the token to a primary account number (PAN) for the payment account. The method also includes validating the cryptogram, generating a directory server nonce (DSN) for the authentication request, and transmitting the DSN and the account number to an access control server (ACS) associated with an issuer of the payment account. The method further includes, in response to an issuer authentication value (IAV), compiling an accountholder authentication value (AAV) including the IAV, the DSN and an amount of the transaction, and transmitting the AAV to one of a merchant and a server.
Abstract:
A method for generating transaction credentials for a user in a transaction, comprising: storing in a mobile device, an encrypted session key, and an encrypted user authentication credential; receiving an authorisation request; initiating a user authorisation process wherein in the event that the user is an authenticated user, the method comprises: decrypting the encrypted session key and encrypted user authentication credential; generating a transaction cryptogram in dependence on the user authentication credential and the session key; transmitting the transaction cryptogram and a user authentication status to a transaction processing entity for use in a transaction
Abstract:
A method and system for transmitting multiple payment accounts for use by a payment device. The method includes allocating a cryptographic personal account number (CPAN) and producing at least one cryptographic master key set relating to this CPAN and transmitting, by a transmitting device, at least one produced cryptographic master key set for storage in a payment device. Further, the method includes receiving, by a receiving device, at least one device personal account number (DPAN), wherein each of the at least one DPAN is associated with a payment account associated with a consumer; generating, by a processing device, a repersonalization script for each of the at least one DPAN, wherein the repersonalization script includes a set of data associated with the corresponding DPAN; and transmitting, by the transmitting device, at least one repersonalization script to the payment device. The payment device is configured to use the CPAN for selected cryptographic calculations, and use the DPAN and the associated set of data for other aspects of a financial transaction.
Abstract:
A payment transaction is performed at a POS (point of sale) device. The device includes a terminal component and a reader component. The reader component includes a contact interface for establishing a data signal path via conductive contact with an integrated circuit (IC) payment card. A payment transaction is initiated. The data signal path is established between the reader component and the IC payment card. The IC payment card is commanded to generate a cryptogram for verification by an issuer of the card. The cryptogram is received from the card. In response to receiving the cryptogram, a command is issued to disable contact reading operation by the reader component.
Abstract:
A method of authentication of a user at a computing device (1) is provided suitable for a transaction or for use of a remote service. A plurality of authentication options is provided to the user at the computing device (1). On selection of an authentication option by the user, an authentication protocol is performed for the selected authentication option. On successful performance of the authentication protocol, the computing device communicates with the remote service to provide a confirmation of successful authentication for the remote service with an identification of which of the plurality of authentication options was selected by the user. This approach can be used to enable transactions by a delegated user, and in fraud detection and prevention. Suitable computing devices and service offerings are also described.
Abstract:
Methods and apparatus for enabling a proximity payment device to generate dynamic data for securely conducting a transaction by emulating a magnetic stripe payment card. In an embodiment, a mobile device processor transmits information to a digital enablement service computer to activate a simulated magnetic stripe payment wallet application stored in the mobile device. The mobile device then receives one or more cryptographic keys, generates an unpredictable number (UN), generates dynamic CVC3 data based on the UN, and then assembles emulated magnetic stripe data. During initiation of a purchase transaction, the mobile device processor transmits the emulated magnetic stripe data to a communications interface associated with a merchant device.
Abstract:
There is provided an authentication system for validating identity credentials of a user attempting to access a resource provided by a remote resource provision system. The authentication system includes an input configured to receive, from the resource provision system, an authentication request comprising a cryptographic representation of digital identity data of the user and an associated token identifier, where the digital identity data comprises at least one image of an identity credential of the user. The system also includes a processor configured to: determine a pre-stored cryptographic identifier corresponding to the token identifier; and compare the received cryptographic representation with the pre-stored cryptographic identifier. The system further includes an output configured to transmit, to the remote resource provision system and in response to determining a match between the received cryptographic representation and the pre-stored cryptographic identifier, an authentication confirmation indicating successful validation of the digital identity data.