Granted Patent B2

US 12,430,631 · App. 17/559,720 · Granted Sep 30, 2025

Inventor: Igor Opushnyev (New Westminster, CA)

Assignee: MASTERCARD TECHNOLOGIES CANADA ULC

G06Q20/308G06F21/602G06Q20/401G16Y30/10H04L9/085H04L9/0872H04L9/0894H04L63/0435G06Q2220/00

Abstract

Claims (89)

1. A computing device comprising:

network communications configured to communicate network data of a network environment;

a memory; and

an electronic processor communicatively coupled to the memory and the network communications, the electronic processor is configured to

receive the network data from the network communications,

receive a transaction setup request, wherein the transaction setup includes setting up access to sensitive data stored in a memory,

responsive to receiving the network data and the transaction setup request, detect a number of available network environment attributes from the network data,

determine an encryption threshold according to a cryptographic algorithm that will be used in encrypting the sensitive data and a required encryption strength,

determine whether the number of available network environment attributes is equal to or greater than the encryption threshold,

responsive to determining that the number is not equal to or greater than the encryption threshold, prompt a user that the sensitive data cannot be securely stored in the memory, and

responsive to determining that the number is equal to or greater than the encryption threshold, perform encryption operations including:

prompt the user that the sensitive data can be securely stored in the memory and to enter the sensitive data,

receive the sensitive data from the user,

generate a secret key based on a portion of the available network environment attributes that are detected, wherein the portion is a second number of available network environment attributes that is equal to or greater than the encryption threshold,

encrypt the sensitive data with the secret key, and

store the encrypted sensitive data in the memory.

2. The computing device of claim 1 , wherein the electronic processor is further configured to decrypt the encrypted sensitive data with the secret key.

3. The computing device of claim 1 , wherein the electronic processor is configured to

receive a payment method request,

retrieve the encrypted sensitive data from the memory,

decrypt the encrypted sensitive data, and

output a payment method from the sensitive data that is decrypted.

4. The computing device of claim 3 , wherein the electronic processor is further configured to

detect a trigger event for an order from a merchant, and

transmit the order with the payment method to a server of the merchant.

5. The computing device of claim 1 , wherein the electronic processor is further configured to

responsive to receiving the sensitive data, request the secret key,

receive the secret key, and

output the encrypted sensitive data.

6. The computing device of claim 1 , wherein the electronic processor is further configured to

split the secret key into a secret key local part and a secret key remote part,

control the memory to store the secret key local part, and

control a key management server to store the secret key remote part or the secret key.

7. The computing device of claim 6 , wherein, to control the key management server to store the secret key remote part or the secret key, the electronic processor is further configured to

encrypt the secret key remote part or the secret key, and

control the key management server to store the secret key remote part that is encrypted or the secret key that is encrypted.

8. The computing device of claim 1 , wherein the network communications includes a local area network (LAN)/Ethernet adapter, a Wi-Fi adapter, a Bluetooth® adapter, or a combination thereof.

9. The computing device of claim 8 , wherein the network environment attributes includes device attributes, and wherein the device attributes includes a device name attribute, a model attribute, a brand attribute, a family attribute, or a combination thereof, and wherein one of the device attributes is associated with a device that is separate and distinct from the computing device.

10. The computing device of claim 8 , wherein the network environment attributes includes LAN attributes associated with the LAN/Ethernet adapter, and wherein the LAN attributes includes netmask attribute, gateway attribute, domain name service (DNS) attribute, or a combination thereof.

11. The computing device of claim 8 , wherein the network environment attributes includes Wi-Fi attributes associated with the Wi-Fi adapter, and wherein the Wi-Fi attributes includes internet service provider (ISP) name attribute, a public internet protocol (IP) address attribute, a location attribute, a time zone attribute, or a combination thereof.

12. The computing device of claim 8 , wherein the network environment attributes includes Wi-Fi access point attributes, and wherein the Wi-Fi access point attributes includes a service set identifier (SSID) attribute, a basic service set identifier (BSSID) attribute, a mode attribute, a channel attribute, a rate attribute, a supported security protocols attribute, or a combination thereof.

13. The computing device of claim 1 , wherein the encryption threshold is a positive integer that is equal to or greater than sixteen.

14. A method comprising:

receiving, by an electronic processor of a computing device, network data from network communications of the computing device;

receiving, by the electronic processor r, a transaction setup request, wherein the transaction setup includes setting up access to sensitive data stored in a memory;

responsive to receiving the network data and the transaction setup request, detecting a number of available network environment attributes from the network data;

determining, by the electronic processor, an encryption threshold according to a cryptographic algorithm that will be used in encrypting the sensitive data and a required encryption strength;

determining, by the electronic processor, whether the number of available network environment attributes is equal to or greater than the encryption threshold;

based on the determination whether the number of available network environment attributes is equal to or greater than the encryption threshold:

prompting, by the electronic processor, a user that the sensitive data can be securely stored in the memory and to enter the sensitive data,

receiving, by the electronic processor, the sensitive data,

generating, by the electronic processor, a secret key based on a portion of the available network environment attributes that are detected, wherein the portion is a second number of available network environment attributes that is equal to or greater than the encryption threshold,

encrypting, by the electronic processor, the sensitive data with the secret key, and

storing, by the electronic processor, the memory to store the encrypted sensitive data in the memory.

15. The method of claim 14 , further comprising:

detecting a trigger event for an order from a merchant;

responsive to detecting the trigger event, retrieving the encrypted sensitive data from the memory;

decrypting the encrypted sensitive data with the secret key;

extracting a payment method from the encrypted sensitive data that is decrypted; and

transmitting the order with the payment method to a server of the merchant.

16. The method of claim 14 , further comprising:

splitting the secret key into a secret key local part and a secret key remote part;

controlling the memory to store the secret key local part; and

controlling a key management server to store the secret key remote part.

17. The method of claim 16 , wherein controlling the key management server to store the secret key remote part further includes

encrypting the secret key remote part; and

controlling the key management server to store the secret key remote part that is encrypted.

18. A non-transitory computer-readable medium comprising instructions that, when executed by an electronic processor, cause the electronic processor to perform a set of operations comprising:

receiving network data from network communications;

receiving a transaction setup request, wherein the transaction setup includes setting up access to sensitive data stored in a memory;

responsive to receiving the network data and the transaction setup request, detecting a number of available network environment attributes from the network data;

determining an encryption threshold according to a cryptographic algorithm that will be used in encrypting the sensitive data and a required encryption strength;

determining whether the number of available network environment attributes is equal to or greater than the encryption threshold;

based on the determination whether the number of available network environment attributes is equal to or greater than the encryption threshold, performing steps of:

prompting a user that sensitive data can be securely stored in the memory and to enter the sensitive data;

receiving the sensitive data;

generating a secret key based on a portion of the available network environment attributes that are detected, wherein the portion is a second number of available network environment attributes that is equal to or greater than the encryption threshold;

encrypting the sensitive data with the secret key; and

storing the encrypted sensitive data in the memory.

19. The non-transitory computer-readable medium of claim 18 , wherein the set of operations further includes

detecting a trigger event for an order from a merchant;

retrieving the encrypted sensitive data from the memory in response to detecting the trigger event;

decrypting the encrypted sensitive data with the secret key;

extracting a payment method from the encrypted sensitive data that is decrypted; and

transmitting the order with the payment method to a server of the merchant.

20. The non-transitory computer-readable medium of claim 18 , wherein the set of operations further includes

splitting the secret key into a secret key local part and a secret key remote part;

controlling the memory to store the secret key local part; and

controlling a key management server to store the secret key remote part.

Assignments (1)

Continuity (1)

References Cited (31)