Granted Patent B2

US 12,646,057 · App. 18/541,281 · Granted Jun 2, 2026

Inventor: Nilesh Upadhye (London, GB)

Assignee: Vocalink International Limited

G06Q20/3829G06Q20/401H04L9/0869G06Q2220/00H04L2209/56

Abstract

Claims (83)

1 . A payment device associated with a financial institution, comprising:

a receiver unit configured to receive request data from a communications device associated with a user, wherein the request data corresponds to a request for a secure limited use key (SLUK), wherein the SLUK is configured for use by the communications device for an electronic payment process with a point of sale (POS) device;

a controller configured to:

generate a first limited use key (LUK), in response to the received request data, based on a variable code, a user identifier associated with the user, and a financial institution key associated with the financial institution;

determine character positions for a passcode using a predetermined algorithm based on a secret key associated with the user, the user identifier, and the variable code, wherein the passcode is associated with the user, and wherein the character positions correspond to a subset of characters of the passcode;

determine the subset of characters of the passcode based on the determined character positions; and

generate the SLUK based on the first LUK and the determined subset of characters of the passcode; and

a transmitter unit configured to transmit the SLUK and the variable code to the communications device.

2 . The payment device of claim 1 , wherein:

the receiver unit is further configured to receive registration request data from the communications device, wherein the registration request data corresponds to a request to register the communications device with the financial institution for use during one or more payment processes, wherein the one or more payment processes comprise the electronic payment process;

the controller is further configured to generate the user identifier and the secret key; and

the transmitter unit is further configured to transmit the user identifier and the secret key to the communications device.

3 . The payment device of claim 1 , wherein:

the receiver unit is further configured to receive message data from the POS device, wherein the message data comprises:

the user identifier;

a first cryptogram generated by the communications device, wherein the first cryptogram corresponds to a second LUK generated by the communications device based on the SLUK transmitted to the communications device and a partial passcode received from the user, wherein the partial passcode corresponds to positions of the passcode determined by the communications device using the predetermined algorithm;

a first Key Check Value (KCV) generated by the communications device based on the second LUK; and

a datagram generated by the POS device, wherein the datagram indicates a payment value associated with the electronic payment process; and

the controller is further configured to:

regenerate the first LUK based on the user identifier, the financial institution key, and the variable code;

generate a second cryptogram based on the regenerated first LUK; and

compare the first cryptogram and the second cryptogram.

4 . The payment device of claim 3 , wherein:

the controller is further configured to:

determine that the first cryptogram and the second cryptogram match based on the comparison of the first cryptogram and the second cryptogram;

facilitate a payment between an account associated with the user and an account associated with the POS device, wherein the payment corresponds to the payment value indicated by the datagram; and

the transmitter unit is further configured to transmit confirmation data to the communications device, the POS device, or both, wherein the confirmation data indicates the electronic payment process has been successfully completed.

5 . The payment device of claim 3 , wherein the controller is further configured to:

determine that the first cryptogram and the second cryptogram do not match based on the comparison of the first cryptogram and the second cryptogram;

generate a second KCV based on the regenerated first LUK; and

compare the first KCV and the second KCV.

6 . The payment device of claim 5 , wherein the controller is further configured to:

determine that the first KCV and the second KCV match based on the comparison of the first KCV and the second KCV; and

determine that the partial passcode received from the user is correct.

7 . The payment device of claim 5 , wherein the controller is further configured to:

determine that the first KCV and the second KCV do not match based on the comparison of the first KCV and the second KCV; and

determine that the partial passcode received from the user is incorrect.

8 . The payment device of claim 1 , wherein:

the user identifier comprises a token primary account number (PAN);

the financial institution key comprises an Issue Master Key (IMK);

the secret key comprises an Advanced Standards Encryption (AES) 128 bit secret key; or

combinations thereof.

9 . The payment device of claim 1 , wherein generate the first LUK comprises:

retrieve the financial institution key from a storage unit; and

determine the variable code, wherein the variable code corresponds to a format DDDNN, wherein DDD represents a number of days since a predetermined first day of a year and NN is a key sequence number ranging from 00 to 99.

10 . The payment device of claim 1 , wherein the controller configured to determine the character positions for the passcode using the predetermined algorithm is further configured to:

generate a cryptographic random number (CRN) based on the secret key, the user identifier, and the variable code;

determine whether a number of characters of the CRN is greater than or equal to a number of characters of the passcode;

if the number of characters of the CRN is greater than or equal to the number of characters of the passcode, determine whether a number of unique characters of the CRN is greater than or equal to a predetermined number; and

if the number of unique characters of the CRN is greater than or equal to the predetermined number, determine the character positions for the passcode based on the unique characters of the CRN.

11 . The payment device of claim 10 , wherein the controller configured to determine the character positions for the passcode based on the unique characters of the CRN is further configured to:

identify a set of the unique characters of the CRN, wherein a number of the unique characters included in the set is equal to the predetermined number;

determine values for the unique characters included in the set; and

determine the character positions for the passcode based on the values for the unique characters included in the set, wherein a respective character position for the passcode corresponds to a value for a respective unique character included in the set.

12 . The payment device of claim 10 , wherein, if the number of characters of the CRN is less than the number of characters of the passcode, the controller is further configured to:

generate a second CRN based on the secret key, the user identifier, and the variable code;

determine whether a number of characters of the second CRN is greater than or equal to a number of characters of the passcode;

if the number of characters of the second CRN is greater than or equal to the number of characters of the passcode, determine whether a number of unique characters of the second CRN is greater than or equal to the predetermined number; and

if the number of unique characters of the second CRN is greater than or equal to the predetermined number, determine the character positions for the passcode based on the unique characters of the second CRN.

13 . The payment device of claim 10 , wherein:

each unique character has a value that is less than or equal to the number of characters of the passcode;

the predetermined number is equal to a number of characters to be included in the subset of characters of the passcode; and

if the number of unique characters of the CRN is less than the predetermined number, the controller is further configured to:

generate a second CRN based on the secret key, the user identifier, and the variable code;

determine whether a number of characters of the second CRN is greater than or equal to a number of characters of the passcode;

if the number of characters of the second CRN is greater than or equal to the number of characters of the passcode, determine whether a number of unique characters of the second CRN is greater than or equal to the predetermined number; and

if the number of unique characters of the second CRN is greater than or equal to the predetermined number, determine the character positions for the passcode based on the unique characters of the second CRN.

14 . The payment device of claim 10 , wherein the controller configured to generate the CRN is further configured to provide the secret key, the user identifier, and the variable code as inputs to a Format Preserving Encryption (FPE) function.

15 . The payment device of claim 1 , wherein the controller configured to determine the subset of characters of the passcode is further configured to:

retrieve the subset of characters of the passcode from a storage unit of the payment device based on the determined character positions, wherein each character of the subset of characters of the passcode corresponds to a respective determined character position for the passcode.

16 . The payment device of claim 1 , wherein the controller configured to generate the SLUK is further configured to perform an encryption algorithm to wrap the first LUK using the determined subset of characters of the passcode.

17 . A method, comprising:

receiving, at a payment device associated with a financial institution, request data from a communications device associated with a user, wherein the request data corresponds to a request for a secure limited use key (SLUK), wherein the SLUK is configured for use by the communications device for an electronic payment process with a point of sale (POS) device;

generating, at the payment device, a first limited use key (LUK), in response to the received request data, based on a variable code, a user identifier associated with the user, and a financial institution key associated with the financial institution;

determining, at the payment device, character positions for a passcode using a predetermined algorithm based on a secret key associated with the user, the user identifier, and the variable code, wherein the passcode is associated with the user, and wherein the character positions correspond to a subset of characters of the passcode;

determining, at the payment device, the subset of characters of the passcode based on the determined character positions;

generating, at the payment device, the SLUK based on the first LUK and the determined subset of characters of the passcode; and

transmitting, from the payment device, the SLUK and the variable code to the communications device.

18 . The method of claim 17 , wherein determining, at the payment device, the character positions for the passcode using the predetermined algorithm comprises:

generating a cryptographic random number (CRN) based on the secret key, the user identifier, and the variable code;

determining whether a number of characters of the CRN is greater than or equal to a number of characters of the passcode;

if the number of characters of the CRN is greater than or equal to the number of characters of the passcode, determining whether a number of unique characters of the CRN is greater than or equal to a predetermined number; and

if the number of unique characters of the CRN is greater than or equal to the predetermined number, determining the character positions for the passcode based on the unique characters of the CRN.

Assignments (2)

Priority Claims (1)

Continuity (2)

References Cited (17)