System and method of session key generation and exchange
Computer-implemented methods and systems reliant on establishing a common session key between an electronic device and a computer server are disclosed. The method and systems may be for processing de-tokenization requests in payment transaction processing and for preparing an electronic device to perform payment transactions. During such a transaction, the server may perform a method that includes receiving a de-tokenization request including a payment token and a cryptogram generated by the electronic device using a session key generated by the electronic device based on a fingerprint of the electronic device, a secret value previously shared with the electronic device, the payment token, and a transaction counter; retrieving the fingerprint, the secret value, and the transaction counter and generating the session key based on the same; verifying the cryptogram using the session key; retrieving an associated account number; and sending response to the request including the account number.
1. A computer system comprising:
a processor;
a memory coupled to the processor, the memory storing instructions that, when executed by the processor, cause the computer system to:
receive, from an electronic device over a secure channel, a provisioning request including a fingerprint of the electronic device and an account number;
generate a secret value and a payment token associated with the account number;
store, in a storage, the fingerprint, the secret value, and the payment token mapped to the account number;
transmit to the electronic device, in response to the provisioning request, a provisioning reply that includes the payment token and the secret value;
receive from the electronic device, via a network, a de-tokenization request, the de-tokenization request including the payment token and a cryptogram, the cryptogram having been generated by the electronic device using a first session key generated by the electronic device based on the fingerprint of the electronic device, a secret value previously shared with the electronic device, the payment token, and a transaction counter;
retrieve, based on the payment token, the fingerprint, the secret value, and the transaction counter from the storage;
in response to retrieving the payment token, the fingerprint, the secret value, and the transaction counter from the storage, generate a second session key based on the fingerprint, the secret value, the payment token, and the transaction counter;
verify the cryptogram using the second session key;
upon successfully verifying the cryptogram, retrieve the account number associated with the payment token from the storage; and
send to the electronic device, via the network, a response to the de-tokenization request including the account number.
2. The computer system of claim 1 wherein the secret value includes a random number.
3. The computer system of claim 1 wherein the cryptogram was generated by the electronic device to perform a payment transaction and wherein the secret value was previously shared with the electronic device in preparation for performing that payment transaction.
4. The computer system of claim 1 wherein the first and the second session keys are generated by applying a cryptographic hash function one or more times using the fingerprint, the secret value, the payment token, and the transaction counter as inputs.
5. The computer system of claim 1 wherein the first and the second session keys are generated using one or more applications of a double-length key triple Data Encryption Standard cipher algorithm.
6. The computer system of claim 1 wherein the fingerprint is based on data in the memory of the electronic device.
7. The computer system of claim 1 wherein the electronic device is a smartphone and the fingerprint is based on at least one of an International Mobile Station Equipment Identity of the smartphone, an International Mobile Subscriber Identity of the smartphone, or an Integrated Circuit Card Identifier of a Subscriber Identity Module coupled to the smartphone.
8. A computer-implemented method comprising:
receiving, from an electronic device over a secure channel, a provisioning request including a fingerprint of the electronic device and an account number;
generating a secret value and a payment token associated with the account number;
storing, in a storage, the fingerprint, the secret value, and the payment token mapped to the account number;
transmitting to the electronic device, in response to the provisioning request, a provisioning reply that includes the payment token and the secret value;
receiving, from the electronic device via a network, a de-tokenization request, the de-tokenization request including the payment token and a cryptogram, the cryptogram having been generated by the electronic device using a first session key generated by the electronic device based on the fingerprint of the electronic device, the secret value previously shared with the electronic device, the payment token, and a transaction counter;
retrieving, based on the payment token, the fingerprint, the secret value, and the transaction counter from the storage;
in response to retrieving the payment token, the fingerprint, the secret value, and the transaction counter from the storage, generate a second session key based on the fingerprint, the secret value, the payment token, and the transaction counter;
verifying the cryptogram using the second session key;
upon successfully verifying the cryptogram, retrieving the account number associated with the payment token from the storage; and
sending, to the electronic device via the network, a response to the de-tokenization request including the account number.
9. The method of claim 8 wherein the secret value includes a random number.
10. The method of claim 8 wherein the cryptogram was generated by the electronic device to perform a payment transaction and wherein the secret value was previously shared with the electronic device in preparation for performing that payment transaction.
11. The method of claim 8 wherein the first and the second session keys are generated by applying a cryptographic hash function one or more times using the fingerprint, the secret value, the payment token, and the transaction counter as inputs.
12. The method of claim 8 wherein the first and the second session keys are generated using one or more applications of a double-length key triple Data Encryption Standard cipher algorithm.
13. The method of claim 8 wherein the fingerprint is based on at least one of data in a memory of the electronic device, an International Mobile Station Equipment Identity associated with the electronic device, an International Mobile Subscriber Identity associated with the electronic device, or an Integrated Circuit Card Identifier of a Subscriber Identity Module coupled to the electronic device.