Secured account provisioning and payments for NFC-enabled devices

1. A method, comprising:

determining, by at least one computing device, that a near-field communication (NFC)-enabled user device passes an initial risk check for receiving secure provisioning;

retrieving, by the at least one computing device, a server root key from a hardware security module;

decrypting, by the at least one computing device, an encrypted account provisioning request with the server root key, wherein the encrypted account provisioning request comprises data including a provisioning account identifier and a device fingerprint, and the encrypted account provisioning request is received from the NFC-enabled user device, wherein the device fingerprint comprises a hash numerical value of one or more attributes of the NFC-enabled user device;

retrieving, by the at least one computing device, transaction account data including a limited use payment credential (LUPC), the transaction account data being retrieved based at least in part on the provisioning account;

generating, by the at least one computing device, an encryption (ENC) key, a message authentication code (MAC) key, and a data encryption key (DEK) key based on the device fingerprint and the server root key, wherein the MAC key comprises a distinct numerical value based on a numerical value contained with the device fingerprint;

generating, by the at least one computing device, an encrypted account payload by:

encrypting, by the at least one computing device, the LUPC in the transaction account data using the DEK key;

encrypting, by the at least one computing device, the transaction account data using the ENC key following encryption of the LUPC; and

digitally signing, by the at least one computing device, the encrypted transaction account data using the MAC key; and

transmitting, by the at least one computing device, the encrypted account payload to the NFC-enabled user device.

2. The method of claim 1 , further comprising invoking, by the at least one computing device, an attestation service executable on the NFC-enabled user device that performs the initial risk check prior to receiving the encrypted account provisioning request.

3. A system comprising:

a processor of a computing device; and

a tangible, non-transitory memory configured to communicate with the processor, the tangible, non-transitory memory having instructions stored thereon that, in response to execution by the processor, cause the processor to be capable of performing operations comprising:

determining that a near-field communication (NFC)-enabled user device passes an initial risk check for receiving secure provisioning data;

retrieving a server root key from a hardware security module;

decrypting an encrypted account provisioning request with the server root key, wherein the encrypted account provisioning request comprises data including a provisioning account identifier and a device fingerprint, and the encrypted account provisioning request is received from the NFC-enabled user device, wherein the device fingerprint comprises a hash numerical value of one or more attributes of the NFC-enabled user device;

retrieving transaction account data including a limited use payment credential (LUPC), the transaction account data being retrieved based at least in part on the provisioning account;

generating an encryption (ENC) key, a message authentication code (MAC) key, and a data encryption key (DEK) key based on the device fingerprint and the server root key, wherein the MAC key comprises a distinct numerical value based on a numerical value contained with the device fingerprint;

generating an encrypted account payload by:

encrypting, by the processor of the computing device, the LUPC in the transaction account data using the DEK key;

encrypting, by the processor of the computing device, the transaction account data using the ENC key following encryption of the LUPC; and

digitally signing, by the processor of the computing device, the encrypted transaction account data using the MAC key; and

transmitting the encrypted account payload to the NFC-enabled user device.

4. The system of claim 3 , wherein the operations further comprise invoking an attestation service executable on the NFC-enabled user device prior to receiving the encrypted account provisioning request, wherein the attestation service comprises the initial risk check.

5. An article of manufacture including a non-transitory, tangible computer readable storage medium having instructions stored thereon that, in response to execution by a computer-based system, cause the computer-based system to perform operations comprising:

determining, by the computer-based system, that a near-field communication (NFC)-enabled user device passes an initial risk check for receiving secure provisioning data;

retrieving, by the computer-based system, a server root key from a hardware security module;

decrypting, by the computer-based system, an encrypted account provisioning request with the server root key, wherein the encrypted account provisioning request comprises data including a provisioning account identifier and a device fingerprint, and the encrypted account provisioning request is received from the NFC-enabled user device, wherein the device fingerprint comprises a hash numerical value of one or more attributes of the NFC-enabled user device;

retrieving, by the computer-based system, transaction account data including a limited use payment credential (LUPC), the transaction account data being retrieved based at least in part on the provisioning account;

generating, by the computer-based system, an encryption (ENC) key, a message authentication code (MAC) key, and a data encryption key (DEK) key based on the device fingerprint and the server root key, wherein the MAC key comprises a distinct numerical value based on a numerical value contained with the device fingerprint;

generating, by the computer-based system, an encrypted account payload by:

encrypting, by the computer-based system, the LUPC in the transaction account data using the DEK key;

encrypting, by the computer-based system, the transaction account data using the ENC key following encryption of the LUPC; and

digitally signing, by the computer-based system, the encrypted transaction account data using the MAC key; and

transmitting, by the computer based system, the encrypted account payload to the NFC-enabled user device.

6. The article of manufacture of claim 5 , wherein the operations further comprise invoking, by the computer-based system, an attestation service on the NFC-enabled user device prior to receiving the encrypted account payload, wherein the attestation service comprises the initial risk check.

7. The method of claim 1 , further comprising receiving, by the at least one computing device, risk data form the NFC-enabled user device, wherein determining that NFC-enabled user device passes the initial risk check is based at least in part on the risk data.

8. The method of claim 1 , wherein the determining, by the at least one computing device, that the NFC-enabled user device passes the initial risk check further comprises checking that the NFC-enabled user device has not been tampered.

9. The method of claim 1 , wherein the one or more attributes of the NFC-enabled user device comprises at least one of a media access control (MAC) address, one or more operating system attributes, an application build identifier, a build serial number, or a subscriber identification module (SIM) card identifier.

10. The method of claim 1 , wherein the account transaction data comprises at least one of a transaction account number, user account access data, a transaction account identifying data, a card security code, a card verification value, or a transaction account balance.

11. The system of claim 3 , wherein the operations further comprise receiving risk data form the NFC-enabled user device, wherein determining that NFC-enabled user device passes the initial risk check is based at least in part on the risk data.

12. The system of claim 3 , wherein the determining that the NFC-enabled user device passes the initial risk check further comprises checking that the NFC-enabled user device has not been tampered.

13. The system of claim 3 , wherein the account transaction data comprises at least one of a transaction account number, user account access data, a transaction account identifying data, a card security code, a card verification value, or a transaction account balance.

14. The article of manufacture of claim 5 , wherein the one or more attributes of the NFC-enabled user device comprises at least one of a media access control (MAC) address, one or more operating system attributes, an application build identifier, a build serial number, or a subscriber identification module (SIM) card identifier.

15. The article of manufacture of claim 5 , wherein the determining, by the computer-based system, that the NFC-enabled user device passes the initial risk check further comprises checking that the NFC-enabled user device has not been tampered.

16. The method of claim 1 , further comprising, requiring secure login information from the NFC-enabled user device before granting the NFC-enabled user device access to selecting a transaction account for provisioning on the NFC-enabled user device.

17. The system of claim 3 , wherein the operations further comprise requiring secure login information from the NFC-enabled user device before granting the NFC-enabled user device access to select a transaction account for provisioning on the NFC-enabled user device.

18. The article of manufacture of claim 5 , wherein the operations further comprise requiring, by the computer-based system, secure login information from the NFC-enabled user device before granting, by the computer-based system, the NFC-enabled user device access to select a transaction account for provisioning on the NFC-enabled user device.

19. The method of claim 1 , wherein the server root key comprises an AES root key.

20. The system of claim 1 , wherein the server root key comprises an AES root key.