Systems and methods for processing mobile payments by provisoning credentials to mobile devices without secure elements
A method for generating and provisioning payment credentials to a mobile device lacking a secure element includes: generating a card profile associated with a payment account, wherein the card profile includes at least payment credentials corresponding to the associated payment account and a profile identifier; provisioning, to a mobile device lacking a secure element, the generated card profile; receiving, from the mobile device, a key request, wherein the key request includes at least a mobile identification number (PIN) and the profile identifier; using the mobile PIN; generating a single use key, wherein the single use key includes at least the profile identifier, an application transaction counter, and a generating key for use in generating a payment cryptogram valid for a single financial transaction; and transmitting the generated single use key to the mobile device.
1 . A method for generating and provisioning payment credentials to a mobile device without the use of a secure element (SE), comprising:
storing, in a database, at least a storage key, a plurality of dynamic card validation code keys, and an application transaction counter associated with a mobile application program;
provisioning, to the mobile device, at least the storage key, an authentication component, and static payment credentials, wherein the static payment credentials are associated with a payment account;
receiving, from the mobile device, a chip authentication program (CAP) token;
validating, by a validation device, the authenticity of the received CAP token;
generating, by a processing device, a session key unpredictable number (KS UN );
generating, by the processing device, a cloud unpredictable number (UN CLOUD );
identifying, by the processing device, an encrypted payload based on a derived dynamic card validation code key (KD CVC3 ), wherein the encrypted payload includes at least a dynamic card validation code key of the plurality of dynamic card validation code keys, the KS UN , and the application transaction counter;
transmitting, by a transmitting device, the encrypted payload to the mobile device for use in generating a dynamic card validation code for use in a financial transaction; and
transmitting, by the transmitting device, at least the KS UN , UN CLOUD , and application transaction counter to an issuer associated with the payment account for use in validating the generated dynamic card validation code used in the financial transaction.
2 . The method of claim 1 , wherein
the KD CVC3 is genuine if the received CAP token is successfully validated, and
the KD CVC3 is fake if the received CAP token is unsuccessfully validated.
3 . The method of claim 1 , wherein validating the authenticity of the CAP token includes validating the authenticity of the CAP token based on at least the provisioned authentication component and an additional credential received from the mobile device.
4 . The method of claim 3 , wherein the additional credential is at least one of: a gesture, a password, a passcode, and a biometric identifier.
5 . The method of claim 1 , wherein validating the authenticity of the CAP token includes validating the authenticity of the CAP token based on at least the application transaction counter.
6 . The method of claim 1 , wherein the encrypted payload is encrypted using at least the storage key.
7 . A system for generating and provisioning payment credentials to a mobile device without the use of a secure element (SE), the system comprising one or more processors and a non-transitory memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:
store, in a database, at least a storage key, a plurality of dynamic card validation code keys, and an application transaction counter associated with a mobile application program;
provision, to the mobile device, at least the storage key, an authentication component, and static payment credentials, wherein the static payment credentials are associated with a payment account;
receive, from the mobile device, a chip authentication program (CAP) token generated based on at least the static payment credentials;
validate the authenticity of the received CAP token;
generate a session key unpredictable number (KS UN );
generate a cloud unpredictable number (UN CLOUD );
identify an encrypted payload based on a derived dynamic card validation code key (KD CVC3 ), wherein the encrypted payload includes at least a dynamic card validation code key of the plurality of dynamic card validation code keys, the KS UN , and the application transaction counter;
transmit the encrypted payload to the mobile device for use in generating a dynamic card validation code for use in a financial transaction; and
transmit at least the KS UN , UN CLOUD , and application transaction counter to an issuer associated with the payment account for use in validating the generated dynamic card validation code used in the financial transaction.
8 . The system of claim 7 , wherein
the KD CVC3 is genuine if the received CAP token is successfully validated, and
the KD CVC3 is fake if the received CAP token is unsuccessfully validated.
9 . The system of claim 7 , further comprising instructions causing the one or more processors to validate the authenticity of the CAP token based on at least the provisioned authentication component and an additional credential received from the mobile device.
10 . The system of claim 9 , wherein the additional credential is at least one of: a gesture, a password, a passcode, and a biometric identifier.
11 . The system of claim 7 , further comprising instructions causing the one or more processors to validate the authenticity of the CAP token based on at least the application transaction counter.
12 . The system of claim 7 , further comprising instructions causing the one or more processors to encrypt the encrypted payload using at least the storage key.