Method, system, and computer program product for network bound proxy re-encryption and PIN translation
A method, system, and computer program product generate, with a payment network, a first value (a) and a second value (g a ), the second value (g a ) based on the first value (a) and a generator value (g); generate, with the payment network, a plurality of random merchant numbers (m i ) for a respective plurality of merchant banks; determine, with the payment network, a merchant product (M) based on a product of the plurality of random merchant numbers (m i ); generate, with the payment network, a public key (pk i ) based on the second value (g a ), the merchant product (M), and the random merchant number (m i ) and a random key (rk i ) based on the merchant product (M) and the random merchant number (m i ) for each respective merchant bank; and communicate, with the payment network, the public key (pk i ) and the random key (rk i ) to at least one respective merchant bank.
1. A computer-implemented method, comprising:
generating, with at least one point-of-sale (POS) terminal, a random number (r) for a transaction message (m) associated with a transaction, wherein the transaction message (m) contains sensitive data, and wherein the sensitive data comprises an identification number associated with a user;
generating, with the at least one POS terminal, a first ciphertext associated with the transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with the transaction message (m), the first ciphertext value encrypted based on the random number (r), a generator value (g), and the transaction message (m); and
ii) a second ciphertext value associated with the random number (r), the second ciphertext value encrypted based on the random number (r) and a terminal public key;
communicating, with the POS terminal, the first ciphertext to at least one payment gateway;
re-encrypting, with the at least one payment gateway, the second ciphertext value based on a terminal random key to transform the second ciphertext value to a re-encrypted second ciphertext value based on a second value (g a ), a merchant product (M), and the random number (r);
communicating, with the at least one payment gateway, the re-encrypted second ciphertext value and the first ciphertext value to at least one respective merchant bank of a plurality of merchant banks;
re-encrypting, with the at least one respective merchant bank of the plurality of merchant banks, the re-encrypted second ciphertext value to transform the re-encrypted second ciphertext value to a second re-encrypted second ciphertext value;
communicating, with the at least one respective merchant bank, the second re-encrypted second ciphertext value and the first ciphertext value to a payment network;
decrypting, with the payment network, the first ciphertext value to form the transaction message (m) based on the second re-encrypted second ciphertext value, the merchant product (M), a random merchant number (m i ), and the first ciphertext value;
communicating, with the payment network, the transaction message (m) associated with the transaction to a consumer bank;
verifying, with the consumer bank, the identification number associated with the user; and
in response to verifying the identification number, authorizing, with the consumer bank, the transaction.
2. The computer-implemented method of claim 1 , further comprising:
generating, with the payment network, a first value (a) and the second value (g a ), the second value (g a ) generated based on the first value (a) and the generator value (g);
generating, with the payment network, a plurality of random merchant numbers (m i ) for a respective plurality of merchant banks;
determining, with the payment network, the merchant product (M) based on a product of the plurality of random merchant numbers (m i ) for the respective plurality of merchant banks;
generating, with the payment network, a public key (pk i ) based on the second value (g a ), the merchant product (M), and the random merchant number (m i ) and a random key (rk i ) based on the merchant product (M) and the random merchant number (m i ) for each respective merchant bank of the plurality of merchant banks; and
communicating, with the payment network, the public key (pk i ) and the random key (rk i ) to the at least one respective merchant bank.
3. The computer-implemented method of claim 2 , further comprising:
generating, with the at least one respective merchant bank of the plurality of merchant banks, a plurality of random payment gateway numbers (p i ) for a respective plurality of payment gateways; and
generating, with the at least one respective merchant bank of the plurality of merchant banks, a payment gateway public key based on the second value (g a ), the merchant product (M), and the random payment gateway number (p i ) and a payment gateway random key based on the random payment gateway number (p i ) for each respective payment gateway of the plurality of payment gateways.
4. The computer-implemented method of claim 3 , further comprising:
generating, with the at least one respective merchant bank of the plurality of merchant banks, a plurality of terminal numbers (t i ) for a respective plurality of POS terminals; and
generating, with the at least one respective merchant bank of the plurality of merchant banks, the terminal public key based on the second value (g a ), the merchant product (M), the random payment gateway number (p i ), and the terminal number (t i ) and the terminal random key based on the random payment gateway number (p i ) and the terminal number (t i ) for each respective POS terminal of the respective plurality of POS terminals.
5. The computer-implemented method of claim 4 , further comprising:
communicating, with the at least one respective merchant bank of the plurality of merchant banks, the terminal public key and the terminal random key to the at least one payment gateway; and
communicating, with the at least one payment gateway, the terminal public key to the at least one POS terminal.
6. The computer-implemented method of claim 1 , wherein the merchant product (M) comprises a result of multiplication of the plurality of random merchant numbers (m i ).
7. A system comprising:
at least one point-of-sale (POS) terminal including one or more processors, wherein the at least one POS terminal is programmed and/or configured to:
generate a random number (r) for a transaction message (m) associated with a transaction, wherein the transaction message (m) contains sensitive data, and wherein the sensitive data comprises an identification number associated with a user;
generate a first ciphertext associated with the transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with the transaction message (m), the first ciphertext value encrypted based on the random number (r), a generator value (g), and the transaction message (m); and
ii) a second ciphertext value associated with the random number (r), the second ciphertext value encrypted based on the random number (r) and a terminal public key; and
communicate the first ciphertext to at least one payment gateway;
the at least one payment gateway including one or more processors, wherein the at least one payment gateway is programmed and/or configured to:
re-encrypt the second ciphertext value based on a terminal random key to transform the second ciphertext value to a re-encrypted second ciphertext value based on a second value (g a ), a merchant product (M), and the random number (r); and
communicate the re-encrypted second ciphertext value and the first ciphertext value to at least one respective merchant bank of a plurality of merchant banks;
the at least one respective merchant bank of a plurality of merchant banks including one or more processors, wherein the at least one respective merchant bank of the plurality of merchant banks is programmed and/or configured to:
re-encrypt the re-encrypted second ciphertext value to transform the re-encrypted second ciphertext value to a second re-encrypted second ciphertext value; and
communicate the second re-encrypted second ciphertext value and the first ciphertext value to at least one payment network;
the at least one payment network including one or more processors, wherein the at least one payment network is programmed and/or configured to:
decrypt the first ciphertext value to form the transaction message (m) based on the second re-encrypted second ciphertext value, the merchant product (M), the random merchant number (m i ), and the first ciphertext value; and
communicate the transaction message (m) associated with the transaction to at least one consumer bank; and
the at least one consumer bank including one or more processors, wherein the at least one consumer bank is programmed and/or configured to:
verify the identification number associated with the user; and
in response to verifying the identification number, authorize the transaction.
8. The system of claim 7 , wherein the at least one payment network is
further programmed and/or configured to:
generate a first value (a) and the second value (g a ), the second value (g a ) generated based on the first value (a) and the generator value (g);
generate a plurality of random merchant numbers (m i ) for a respective plurality of merchant banks;
determine the merchant product (M) based on a product of the plurality of random merchant numbers (m i ) for the respective plurality of merchant banks;
generate a public key (pk i ) based on the second value (g a ), the merchant product (M), and the random merchant number (m i ) and a random key (rk i ) based on the merchant product (M) and the random merchant number (m i ) for each respective merchant bank of the plurality of merchant banks; and
communicate the public key (pk i ) and the random key (rk i ) to at least one respective merchant bank of the plurality of merchant banks.
9. The system of claim 8 , wherein the at least one respective merchant bank of the plurality of merchant banks is further programmed and/or configured to:
generate a plurality of random payment gateway numbers (p i ) for a respective plurality of payment gateways; and
generate a payment gateway public key based on the second value (g a ), the merchant product (M), and the random payment gateway number (p i ) and a payment gateway random key based on the random payment gateway number (p i ) for each respective payment gateway of the plurality of payment gateways.
10. The system of claim 9 , wherein the respective merchant bank of the plurality of merchant banks is further programmed and/or configured to:
generate a plurality of terminal numbers (t i ) for a respective plurality of POS terminals; and
generate the terminal public key based on the second value (g a ), the merchant product (M), the random payment gateway number (p i ), and the terminal number (t i ) and the terminal random key based on the random payment gateway number (p i ) and the terminal number (t i ) for each respective POS terminal of the plurality of POS terminals.
11. The system of claim 10 , wherein the at least one respective merchant bank of the plurality of merchant banks is further programmed and/or configured to:
communicate the terminal public key and the terminal random key to the at least one payment gateway, and
wherein the at least one payment gateway is further programmed and/or configured to:
communicate the terminal public key to the at least one POS terminal.
12. The system of claim 7 , wherein the merchant product (M) comprises a result of multiplication of the plurality of random merchant numbers (m i ).
13. A computer program product comprising at least one non-transitory computer-readable medium including program instructions that, when executed by at least one processor, cause the at least one processor to:
generate, with at least one point-of-sale (POS) terminal, a random number (r) for a transaction message (m) associated with a transaction, wherein the transaction message (m) contains sensitive data, and wherein the sensitive data comprises an identification number associated with a user;
generate, with the at least one POS terminal, a first ciphertext associated with the transaction, the first ciphertext comprising:
(i) a first ciphertext value associated with the transaction message (m), the first ciphertext value encrypted based on the random number (r), a generator value (g), and the transaction message (m); and
ii) a second ciphertext value associated with the random number (r), the second ciphertext value encrypted based on the random number (r) and a terminal public key;
communicate, with the POS terminal, the first ciphertext to at least one payment gateway;
re-encrypt, with the at least one payment gateway, the second ciphertext value based on a terminal random key to transform the second ciphertext value to a re-encrypted second ciphertext value based on a second value (g a ), a merchant product (M), and the random number (r);
communicate, with the at least one payment gateway, the re-encrypted second ciphertext value and the first ciphertext value to at least one respective merchant bank of a plurality of merchant banks;
re-encrypt, with the at least one respective merchant bank of the plurality of merchant banks, the re-encrypted second ciphertext value to transform the re-encrypted second ciphertext value to a second re-encrypted second ciphertext value;
communicate, with the at least one respective merchant bank, the second re-encrypted second ciphertext value and the first ciphertext value to a payment network;
decrypt, with the payment network, the first ciphertext value to form the transaction message (m) based on the second re-encrypted second ciphertext value, the merchant product (M), a random merchant number (m i ), and the first ciphertext value;
communicate, with the payment network, the transaction message (m) associated with the transaction to a consumer bank;
verify, with the consumer bank, the identification number associated with the user; and
in response to verifying the identification number, authorize, with the consumer bank, the transaction.
14. The computer program product of claim 13 , wherein the instructions further cause the at least one processor to:
generate, with the payment network, a first value (a) and the second value (g a ), the second value (g a ) generated based on the first value (a) and the generator value (g);
generate, with the payment network, a plurality of random merchant numbers (m i ) for a respective plurality of merchant banks;
determine, with the payment network, the merchant product (M) based on a product of the plurality of random merchant numbers (m i ) for the respective plurality of merchant banks;
generate, with the payment network, a public key (pk i ) based on the second value (g a ), the merchant product (M), and the random merchant number (m i ) and a random key (rk i ) based on the merchant product (M) and the random merchant number (m i ) for each respective merchant bank of the plurality of merchant banks; and
communicate, with the payment network, the public key (pk i ) and the random key (rk i ) to the at least one respective merchant bank of the plurality of merchant banks.
15. The computer program product of claim 14 , wherein the instructions further cause the at least one processor to:
generate, with the at least one respective merchant bank of the plurality of merchant banks, a plurality of random payment gateway numbers (p i ) for a respective plurality of payment gateways; and
generate, with the at least one respective merchant bank of the plurality of merchant banks, a payment gateway public key based on the second value (g a ), the merchant product (M), and the random payment gateway number (p i ) and a payment gateway random key based on the random payment gateway number (p i ) for each respective payment gateway of the plurality of payment gateways.
16. The computer program product of claim 15 , wherein the instructions further cause the at least one processor to:
generate, with the at least one respective merchant bank of the plurality of merchant banks, a plurality of terminal numbers (t i ) for a respective plurality of POS terminals; and
generate, with the at least one respective merchant bank of the plurality of merchant banks, the terminal public key based on the second value (g a ), the merchant product (M), the random payment gateway number (p i ), and the terminal number (t i ) and the terminal random key based on the random payment gateway number (p i ) and the terminal number (t i ) for each respective POS terminal of the plurality of POS terminals.
17. The computer program product of claim 16 , wherein the instructions further cause the at least one processor to:
communicate, with the at least one respective merchant bank of the plurality of merchant banks, the terminal public key and the terminal random key to the at least one payment gateway; and
communicate, with the at least one payment gateway, the terminal public key to the at least one POS terminal.
18. The computer program product of claim 14 , wherein the merchant product (M) comprises a result of multiplication of the plurality of random merchant numbers (m i ).