Binding cryptogram with protocol characteristics

1. A method of conducting a transaction involving a communication device and an access device using a short range communication channel, the method comprising:

receiving, by the communication device from the access device via the short range communication channel, an anti-collision command;

receiving, by the communication device from the access device via the short range communication channel, an information request comprising transaction level data, the transaction level data comprising data relating to application selection and/or transaction processing;

responsive to receiving the anti-collision command, generating a random value, by the communication device, wherein the random value is a PUPI (pseudo unique PICC identifier);

hashing the random value to form a hashed random value;

generating, by the communication device using a cryptogram generation module in a memory in the communication device, a cryptogram by encrypting at least the transaction level data, and the hashed random value;

transmitting, by the communication device via the short range communication channel, the transaction level data, the hashed random value, and a tag assigned for interoperability level data to the access device, the hashed random value preceded by the tag; and

transmitting, by the communication device via the short range communication channel, the cryptogram to the access device,

wherein the access device or a remote server computer in communication with the access device validates the cryptogram before allowing the transaction to proceed, by

decrypting the cryptogram to obtain the transaction level data, and the hashed random value,

comparing, the received transaction level data, and the hashed random value received from the communication device with the transaction level data, and the hashed random value obtained from the cryptogram to determine if the received cryptogram is valid; and

allowing the transaction to proceed if the received cryptogram is valid,

wherein the access device is a point of sale terminal, and

wherein the short range communication channel is an NFC channel, and

wherein the communication device is a payment card.

2. The method of claim 1 , wherein the access device validates the cryptogram, and wherein the access device is programmed to reject the transaction if the access device cannot validate the cryptogram.

3. The method of claim 1 , wherein generating the cryptogram comprises encrypting the transaction level data, and the hashed random value using an authorizing entity cryptographic key, and wherein the access device or the remote server computer uses a corresponding authorizing entity cryptographic key to validate the cryptogram.

4. The method of claim 3 , wherein the authorizing entity cryptographic key and the corresponding authorizing entity cryptographic key are symmetric keys.

5. The method of claim 1 , wherein the transaction level data is not needed for the communication device and the access device to communicate, and wherein the transaction level data allows the communication device and the access device to complete the transaction.

6. The method of claim 1 , wherein the transaction level data, the hashed random value, the tag, and the cryptogram are transmitted in a single message from the communication device to the access device.

7. The method of claim 1 , wherein the transaction level data comprise at least one of primary account number, a token, and/or an unpredictable number.

8. The method of claim 1 , wherein, the information request is received is received in an application selection command, which includes selection of an application to use from a plurality of applications on the communication device.

9. The method of claim 1 , wherein the information request is in a get processing options command which includes point of sale terminal transaction data requested by the communication device.

10. The method of claim 1 , wherein the payment card is a credit card, and wherein comparing is performed by the access device.

11. The method of claim 1 , wherein the payment card complies with ISO/IEC 14443.

12. A communication device comprising:

a data processor; and

a non-transitory computer readable medium coupled to the data processor, the non-transitory computer readable medium comprising code, executable by the data processor, for implementing a method of conducting a transaction involving the communication device and an access device using a short range communication channel, the method comprising;

receiving, from the access device via the short range communication channel, an anti-collision command;

receiving, from the access device via the short range communication channel, an information request comprising transaction level data, the transaction level data comprising data relating to application selection and/or transaction processing;

responsive to receiving the anti-collision command, generating a random value, wherein the random value is a PUPI (pseudo unique PICC identifier);

hashing the random value to form a hashed random value;

generating, by the communication device using a cryptogram generation module in a memory in the communication device, a cryptogram by encrypting at least the transaction level data, and the hashed random value,

transmitting via the short range communication channel the transaction level data, the hashed random value, and a tag that is assigned for interoperability level data to the access device, the hashed random value preceded by the tag; and

transmitting via the short range communication channel the cryptogram to the access device,

wherein the access device or a remote server computer in communication with the access device validates the cryptogram before allowing the transaction to proceed, by

decrypting the cryptogram to obtain the transaction level data, and the hashed random value,

comparing, the received transaction level data, and the hashed random value received from the communication device with the transaction level data, and the hashed random value obtained from the cryptogram to determine if the received cryptogram is valid; and

allowing the transaction to proceed if the received cryptogram is valid,

wherein the access device is a point of sale terminal, and

wherein the short range communication channel is an NFC channel, and wherein the communication device is a payment card.

13. The communication device of claim 12 , wherein the access device validates the cryptogram, and wherein the access device is programmed to reject the transaction if the access device cannot validate the cryptogram.

14. The communication device of claim 12 , wherein generating the cryptogram comprises encrypting the transaction level data, and the hashed random value using an authorizing entity cryptographic key, and wherein the access device or the remote server computer uses a corresponding authorizing entity cryptographic key to validate the cryptogram.

15. The communication device of claim 14 , wherein the authorizing entity cryptographic key and the corresponding authorizing entity cryptographic key are symmetric keys.

16. A method involving an interaction between an access device and a communication device using a short range communication channel, the method comprising:

providing, by the access device to the communication device via the short range communication channel, an anti-collision command;

providing, by the access device to the communication device via the short range communication channel, an information request comprising transaction level data comprising data relating to application selection and/or transaction processing, wherein responsive to the anti-collision command, the communication device generates a random value, wherein the random value is a PUPI (pseudo unique PICC identifier), hashes the random value to form a hashed random value, and generates, using a cryptogram generation module in a memory of the communication device, a cryptogram by encrypting the transaction level data, and the hashed random value;

receiving, by the access device from the communication device via the short range communication channel, the transaction level data, the hashed random value, a tag that is assigned for interoperability level data, and the cryptogram, the hashed random value preceded by the tag;

generating an authorization request message comprising the transaction level data; and

transmitting the authorization request message to an authorizing entity computer, wherein the authorizing entity computer approves or declines the authorization request message,

wherein the access device is a point of sale terminal, and

wherein the short range communication channel is an NFC channel, and

wherein the communication device is a payment card.

17. The method of claim 16 , wherein transmitting the authorization request message to the authorizing entity computer comprises transmitting the authorization request message to the authorizing entity computer via a processing network and a transport computer.

18. The method of claim 17 , wherein the access device, the transport computer, the processing network, or the authorizing entity computer validates the cryptogram before allowing the interaction to proceed.