Method, system, and computer program product for network bound proxy re-encryption and pin translation
A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (ga), the second value (ga) generated based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (mi) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (mi); generate, with the payment network, a public key (pki) based on the second value (ga), the merchant product (M), and the random merchant number (mi) and a random key (rki) based on the merchant product (M) and the random merchant number (mi) for each respective merchant bank; and communicate, with the payment network, the public key (pki) and the random key (rki) to at least one respective merchant bank.
1. A computer-implemented method comprising:
generating, by a point-of-sale (POS) terminal, a first ciphertext associated with a transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with a randomly selected key (r), the first ciphertext value encrypted based on the randomly selected key (r) and a generator value (g); and
(ii) a second ciphertext value associated with a first public key (pk 1 ) of a first pair of keys comprising a first public key (pk 1 ) and a first secret key (sk 1 ), the first public key (pk 1 ) generated based on the first secret key (sk 1 ) and the generator value (g), the second ciphertext value encrypted based on transaction data associated with the transaction and a symmetric key (K) generated based on the first public key (pk 1 ) and the randomly selected key (r);
communicating, by the POS terminal, the first ciphertext to at least one payment gateway;
re-encrypting, by the at least one payment gateway, the first ciphertext value with a first re-encryption key to transform the first ciphertext value encrypted under the first public key (pk 1 ) to a re-encrypted first ciphertext value encrypted under a second public key (pk 2 ) associated with the at least one payment gateway;
communicating, by the at least one payment gateway, the re-encrypted first ciphertext value and the second ciphertext value to at least one merchant bank;
re-encrypting, by the at least one merchant bank, the re-encrypted first ciphertext value encrypted with a second re-encryption key to transform the re-encrypted first ciphertext value encrypted under the second public key (pk 2 ) of the at least one payment gateway to a second re-encrypted first ciphertext value under a third public key (pk 3 ) of the at least one merchant bank;
communicating, by the at least one merchant bank, the second re-encrypted first ciphertext value and the second ciphertext value to a payment network;
re-encrypting, by the payment network, the second re-encrypted first ciphertext value encrypted with a third re-encryption key to transform the second re-encrypted first ciphertext value encrypted under the third public key (pk 3 ) of the at least one merchant bank to a third re-encrypted first ciphertext value under a fourth public key (pk 4 ) of the payment network;
communicating, by the payment network, the third re-encrypted first ciphertext value and the second ciphertext value to at least one consumer bank;
determining, by the at least one consumer bank, the symmetric key (K) based on the third re-encrypted first ciphertext value and a secret key of the consumer bank; and
decrypting, by the at least one consumer bank, the second ciphertext value based on the symmetric key (K) to obtain the transaction data.
2. The computer-implemented method of claim 1 , wherein an intermediary server translates between multiple different parties by decrypting the second ciphertext value and using a portion of the transaction data to determine routing and a corresponding re-encryption key for a subsequent communication.
3. The computer-implemented method of claim 1 , wherein the transaction data includes at least one of a mobile personal identification number (PIN), a card verification number, or a card number associated therewith.
4. The computer-implemented method of claim 1 , wherein the second ciphertext value is used to encrypt a personal identification number (PIN) under the randomly selected key (r) protected by the first ciphertext value, and wherein a re-encryption generates a new ciphertext value while the second ciphertext value is unchanged.
5. A system comprising:
a point-of-sale (POS) terminal;
at least one payment gateway;
at least one merchant bank;
a payment network;
at least one consumer bank;
the POS terminal comprising at least one POS processor and at least one POS non-transitory computer-readable medium comprising program instructions that, when executed by the at least one POS processor, cause the at least one POS processor to:
generate a first ciphertext associated with a transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with a randomly selected key (r), the first ciphertext value encrypted based on the randomly selected key (r) and a generator value (g); and
(ii) a second ciphertext value associated with a first public key (pk 1 ) of a first pair of keys comprising a first public key (pk 1 ) and a first secret key (sk 1 ), the first public key (pk 1 ) generated based on the first secret key (sk 1 ) and the generator value (g), the second ciphertext value encrypted based on transaction data associated with the transaction and a symmetric key (K) generated based on the first public key (pk 1 ) and the randomly selected key (r); and
communicate the first ciphertext to the at least one payment gateway;
the at least one payment gateway comprising at least one payment gateway processor and at least one payment gateway non-transitory computer-readable medium comprising program instructions that, when executed by the at least one payment gateway processor, cause the at least one payment gateway processor to:
re-encrypt the first ciphertext value with a first re-encryption key to transform the first ciphertext value encrypted under the first public key (pk 1 ) to a re-encrypted first ciphertext value encrypted under a second public key (pk 2 ) associated with the at least one payment gateway; and
communicate the re-encrypted first ciphertext value and the second ciphertext value to the at least one merchant bank;
the at least one merchant bank comprising at least one merchant bank processor and at least one merchant bank non-transitory computer-readable medium comprising program instructions that, when executed by the at least one merchant bank processor, cause the at least one merchant bank processor to:
re-encrypt the re-encrypted first ciphertext value encrypted with a second re-encryption key to transform the re-encrypted first ciphertext value encrypted under the second public key (pk 2 ) of the at least one payment gateway to a second re-encrypted first ciphertext value under a third public key (pk 3 ) of the at least one merchant bank; and
communicate the second re-encrypted first ciphertext value and the second ciphertext value to the payment network;
the payment network comprising at least one payment network processor and at least one payment network non-transitory computer-readable medium comprising program instructions that, when executed by the at least one payment network processor, cause the at least one payment network processor to:
re-encrypt the second re-encrypted first ciphertext value encrypted with a third re-encryption key to transform the second re-encrypted first ciphertext value encrypted under the third public key (pk 3 ) of the at least one merchant bank to a third re-encrypted first ciphertext value under a fourth public key (pk 4 ) of the payment network; and
communicate the third re-encrypted first ciphertext value and the second ciphertext value to the at least one consumer bank; and
the at least one consumer bank comprising at least one consumer bank processor and at least one consumer bank non-transitory computer-readable medium comprising program instructions that, when executed by the at least one consumer bank processor, cause the at least one consumer bank processor to:
determine the symmetric key (K) based on the third re-encrypted first ciphertext value and a secret key of the consumer bank; and
decrypt the second ciphertext value based on the symmetric key (K) to obtain the transaction data.
6. The system of claim 5 , further comprising:
an intermediary server comprising at least one intermediary server processor and at least one intermediary server non-transitory computer-readable medium comprising program instructions that, when executed by the at least one intermediary server processor, cause the at least one intermediary server processor to: translate between multiple different parties by decrypting the second ciphertext value and using a portion of the transaction data to determine routing and a corresponding re-encryption key for a subsequent communication.
7. The system of claim 5 , wherein the transaction data includes at least one of a mobile personal identification number (PIN), a card verification number, or a card number associated therewith.
8. The system of claim 5 , wherein the second ciphertext value is used to encrypt a personal identification number (PIN) under the randomly selected key (r) protected by the first ciphertext value, and wherein a re-encryption generates a new ciphertext value while the second ciphertext value is unchanged.