Mobile payments using multiple cryptographic protocols
Systems, methods, and computer readable media are provided for improving the usability of a cryptogram generated in a first cryptographic protocol such as triple-DES. The methods may generate a first cryptogram using a first identifier in a first cryptographic protocol, stored in a key store within an insecure memory of the mobile communication device, generate, within a secure memory of the mobile communication device, a second cryptogram using a second identifier in a second cryptographic protocol, stored in the secure memory, combining, the first cryptogram and a number of characters of the second cryptogram equal to the length of the first cryptogram to generate a third cryptogram and transmitting the third cryptogram to an payment processing network to validate a transaction. A transaction associated with the third cryptogram may be validated by an authorization entity or an issue entity.
1 . A method comprising:
generating, by a mobile communication device, a first cryptogram using a first identifier and a first cryptographic key, the first cryptographic key being associated with a first cryptographic protocol and being compatible to be stored in a memory of the mobile communication device, wherein the first cryptographic key is stored in the memory and the first cryptogram has a first length;
generating, within a key store of the mobile communication device, a second cryptogram using a second identifier and a second cryptographic key, the second cryptographic key being associated with a second cryptographic protocol and being compatible to be stored in the key store, wherein the second cryptographic key is incompatible to be stored in the memory, wherein the second cryptographic key is stored in the key store and is different than the first cryptographic key, the second cryptogram having a second length that is greater than the first length of the first cryptogram;
modifying the second cryptogram to generate a modified second cryptogram, the modified second cryptogram being generated by removing one or more characters from the second cryptogram in accordance with a pattern, the modified second cryptogram having a length equal to the first length of the first cryptogram;
combining, by the mobile communication device, the first cryptogram and the modified second cryptogram to generate a third cryptogram, wherein the combining comprises applying a reversible logical operation to the first cryptogram and a number of characters of the modified second cryptogram; and
transmitting, by the mobile communication device, the third cryptogram in an authorization request message to a payment processing computer.
2 . The method of claim 1 , further comprising:
receiving, by the payment processing computer, the authorization request message including the third cryptogram;
removing, by the payment processing computer, characters of the second cryptogram from the third cryptogram to produce the first cryptogram; and
transmitting, by the payment processing computer, an updated authorization request message including the first cryptogram to an issuer computer.
3 . The method of claim 2 , further comprising:
receiving, by the issuer computer, the updated authorization request message including the first cryptogram;
comparing, by the issuer computer, the first cryptogram against a known credential; and
transmitting, by the issuer computer, to the mobile communication device, an approval in an authorization response message in response to determining that the first cryptogram matches the known credential.
4 . The method of claim 1 , further comprising:
receiving, by the payment processing computer, the authorization request message including the third cryptogram;
generating, by the payment processing computer, a first test cryptogram using a first test identifier and the first cryptographic key;
generating, by the payment processing computer, a second test cryptogram using a second test identifier and the second cryptographic key;
combining, by the payment processing computer, the first test cryptogram and a number of characters of the second test cryptogram equal to the first length of the first test cryptogram to generate a third test cryptogram;
comparing, by the payment processing computer, the third cryptogram against the third test cryptogram; and
transmitting, by the payment processing computer, to the mobile communication device, an approval in an authorization response message in response to determining that the third cryptogram matches the third test cryptogram.
5 . The method of claim 1 , wherein the first cryptographic key is a triple-DES key.
6 . The method of claim 1 , wherein the second cryptographic key is an AES key.
7 . The method of claim 1 , wherein the reversible logical operation is an exclusive or (XOR).
8 . A mobile communication device comprising:
a processor; and
a computer readable medium coupled to the processor and containing instructions for causing the processor to perform operations comprising:
generating a first cryptogram using a first identifier and a first cryptographic key, the first cryptographic key being associated with a first cryptographic protocol and being compatible to be stored in a memory of the mobile communication device, wherein the first cryptographic key is stored in the memory and the first cryptogram has a first length;
generating, within a key store, a second cryptogram using a second identifier and a second cryptographic key, the second cryptographic key being associated with a second cryptographic protocol and being compatible to be stored in the key store, wherein the second cryptographic key is incompatible to be stored in the memory, wherein the second cryptographic key is stored in the key store and is different than the first cryptographic key, the second cryptogram having a second length that is greater than the first length of the first cryptogram;
modifying the second cryptogram to generate a modified second cryptogram, the modified second cryptogram being generated by removing one or more characters from the second cryptogram in accordance with a pattern, the modified second cryptogram having a length equal to the first length of the first cryptogram;
combining, by the mobile communication device, the first cryptogram and the modified second cryptogram to generate a third cryptogram, wherein the combining comprises applying a reversible logical operation to the first cryptogram and a number of characters of the modified second cryptogram; and
transmitting the third cryptogram in an authorization request message to an authorizing entity.
9 . The mobile communication device of claim 8 , wherein combining the first cryptogram and the modified second cryptogram to generate the third cryptogram further comprises applying an exclusive or (XOR) function to the first cryptogram and the modified second cryptogram.
10 . The mobile communication device of claim 8 , wherein the first cryptographic key is a triple-DES key.
11 . The mobile communication device of claim 8 , wherein the second cryptographic key is an AES key.
12 . A payment processing computer comprising:
a processor; and
a computer readable medium coupled to the processor and containing instructions for causing the processor to perform operations comprising:
receiving, from a mobile communication device, an authorization request message including a third cryptogram, wherein the third cryptogram was generated from a first cryptogram in a first cryptographic key and a modified second cryptogram generated from a second cryptogram in a second cryptographic key combined via a reversible logical operation, wherein the first cryptographic key is associated with a first cryptographic protocol and is compatible to be stored in a memory of the mobile communication device, the first cryptographic key being stored in the memory, and wherein the second cryptographic key is associated with a second cryptographic protocol and is compatible to be stored in a key store of the mobile communication device, wherein the second cryptographic key is incompatible to be stored in the memory and is stored in the key store, the second cryptographic key being different than the first cryptographic key, and wherein the first cryptogram has a first length and the second cryptogram has a second length that is greater than the first length of the first cryptogram, wherein the modified second cryptogram has a length equal to the first length of the first cryptogram; by the mobile communication device by:
generating a first cryptogram using a first identifier and a first cryptographic key, the first cryptographic key being associated with a first cryptographic protocol and being compatible to be stored in a memory of the mobile communication device, wherein the first cryptographic key is stored in the memory and the first cryptogram has a first length;
generating, within a key store of the mobile communication device, a second cryptogram using a second identifier and a second cryptographic key, the second cryptographic key being associated with a second cryptographic protocol, wherein the second cryptographic key is incompatible to be stored in the memory, wherein the second cryptographic key is stored in the key store and is different than the first cryptographic key, the second cryptogram having a second length that is greater than the first length of the first cryptogram;
modifying the second cryptogram to generate a modified second cryptogram, the modified second cryptogram being generated by removing one or more characters from the second cryptogram in accordance with a pattern, the modified second cryptogram having a length equal to the first length of the first cryptogram; and
combining the first cryptogram and the modified second cryptogram to generate the third cryptogram, wherein the combining comprises applying a reversible logical operation to the first cryptogram and a number of characters of the modified second cryptogram;
authenticating the authorization request message based on the third cryptogram; and
transmitting an authorization response message to the mobile communication device.
13 . The payment processing computer of claim 12 , the operations of authenticating the authorization request message based on the third cryptogram further comprising:
removing characters of the second cryptogram from the third cryptogram to produce the first cryptogram.
14 . The payment processing computer of claim 13 , wherein the operations of removing the characters of the second cryptogram from the third cryptogram to produce the first cryptogram further comprise combining the second cryptogram and the third cryptogram with the reversible logical operation.
15 . The payment processing computer of claim 13 , the operations further comprise:
transmitting, to an issuer computer, an updated authorization request message including the first cryptogram; and
receiving, from the issuer computer, an approval in the authorization response message in response to determining that the first cryptogram matches a known credential.
16 . The payment processing computer of claim 12 , wherein the operations for authenticating the authorization request message based on the third cryptogram comprises operations for:
generating a first test cryptogram using a first test identifier and the first cryptographic key;
generating a second test cryptogram using a second test identifier and the second cryptographic key;
combining the first test cryptogram and a number of characters of the second test cryptogram equal to a length of the first test cryptogram to generate a third test cryptogram;
comparing the third cryptogram against the third test cryptogram; and
generating an approval in the authorization response message in response to determining that the third cryptogram matches the third test cryptogram.
17 . The payment processing computer of claim 12 , wherein the first cryptographic key is a triple-DES key.
18 . The payment processing computer of claim 12 , wherein the second cryptographic key is an AES key.
19 . The payment processing computer of claim 12 , wherein the reversible logical operation is an exclusive or (XOR).