Granted Patent B2

US 12,469,021 · App. 17/489,227 · Granted Nov 11, 2025

Inventors: Hao Ngo (San Jose, CA); Christian Aabye (Foster City, CA); John Sheets (San Francisco, CA); Oleg Makhotin (Paris, FR)

Assignee: Visa International Service Association

G06Q20/327G06Q20/32G06Q20/322G06Q20/3829G06Q20/385H04L9/0869G06Q2220/00H04L63/0428H04L2209/24

Abstract

Claims (57)

1 . A method comprising:

receiving, by a communication device from a computer system, a limited-use key (LUK) that is associated with one or more limited-use thresholds that limits usage of the LUK;

receiving, by the communication device from the computer system, a key index with the LUK, the key index including a counter value indicating a number of times that the LUK has been renewed in a predetermined time period and time information indicating when the LUK was generated, and wherein the computer system encrypts account information with a first encryption key to generate a second encryption key, and encrypts the key index with the second encryption key to generate the LUK;

receiving, by the communication device from an access device, transaction data for a transaction;

generating, by the communication device, a transaction cryptogram for the transaction by encrypting the transaction data with the LUK; and

sending, by the communication device, the transaction cryptogram and the key index to the access device to conduct the transaction, thereby causing the access device to provide the transaction cryptogram and the key index to the computer system via an authorization request message, and causing the computer system to verify that the transaction cryptogram was encrypted using the LUK by regenerating the transaction cryptogram using the key index, verify that the LUK has not exceeded the one or more limited-use thresholds, and authorize the transaction based on the verification of the transaction cryptogram and further based on the verification that the LUK has not exceeded the one or more limited-use thresholds.

2 . The method of claim 1 , wherein the account information includes an account identifier or a token that is a substitute for the account identifier.

3 . The method of claim 1 , wherein the account information includes a token that is a substitute for an account identifier, and further comprising:

sending, by the communication device, the token to the access device along with the transaction cryptogram and the key index, wherein the access device provides the token to the computer system via the authorization request message, and wherein the computer system authorizes the transaction further based on the token.

4 . The method of claim 1 , wherein generating the transaction cryptogram includes:

enciphering the transaction data using a first portion of the LUK;

deciphering the enciphered transaction data using a second portion of the LUK; and

re-enciphering the deciphered transaction data using the first portion of the LUK.

5 . The method of claim 1 , wherein generating the transaction cryptogram takes place when the communication device is placed in proximity to the access device, and wherein sending the transaction cryptogram and the key index to the access device is performed by transmitting the transaction cryptogram and the key index to a contactless reader of the access device.

6 . The method of claim 1 , wherein sending the transaction cryptogram and the key index to the access device includes displaying a QR code a screen of the communication device for scanning by the access device, where the transaction cryptogram and the key index are encoded into the QR code.

7 . The method of claim 1 , further comprising:

sending, by the communication device to the access device, a request for the transaction data.

8 . The method of claim 1 , wherein the transaction is conducted without using a secure element.

9 . The method of claim 1 , wherein generating the transaction cryptogram includes:

encrypting a predetermined numeric string using the LUK; and

decimalizing the encrypted predetermined numeric string.

10 . The method of claim 9 , wherein decimalizing the encrypted predetermined numeric string includes:

extracting numeric digits from the encrypted predetermined numeric string to form a first data block;

extracting hexadecimal digits from the encrypted predetermined numeric string and converting each extracted hexadecimal digit into a numeric digit to form a second data block; and

concatenating the first data block and the second data block.

11 . A system comprising:

a computer system comprising:

one or more first processors; and

one or more first memories storing computer-readable code, which when executed by the one or more first processors, causes the computer system to perform first operations including:

encrypting account information with a first encryption key to generate a second encryption key;

encrypting a key index using the second encryption key to generate a limited-use key (LUK), wherein the key index includes a counter value indicating a number of times that the LUK has been renewed in a predetermined time period, and time information indicating when the LUK is generated, and wherein the LUK is associated with one or more limited-use thresholds that limits usage of the LUK;

providing the LUK and the key index to a communication device;

receiving the key index and a transaction cryptogram;

verifying that the transaction cryptogram was encrypted using the LUK and that the LUK has not exceeded the one or more limited-use thresholds, wherein verifying that the transaction cryptogram was encrypted using the LUK includes:

regenerating the transaction cryptogram using the received key index; and

based on the verifying, authorizing a transaction; and

the communication device comprising:

one or more second processors; and

one or more second memories storing computer-readable code, which when executed by the one or more second processors, causes the communication device to perform second operations including:

receiving, from the computer system, the LUK,

receiving, from the computer system, the key index with the LUK;

receiving, from an access device, transaction data for the transaction;

generating the transaction cryptogram for the transaction by encrypting the transaction data with the LUK; and

sending, to the computer system, the transaction cryptogram and the key index to the access device to conduct the transaction, wherein the access device provides the transaction cryptogram and the key index to the computer system via an authorization request message.

12 . The system of claim 11 , wherein the verifying that the transaction cryptogram was encrypted using the LUK includes comparing the regenerated transaction cryptogram to the received transaction cryptogram.

13 . The system of claim 11 , wherein the transaction is conducted without using a secure element.

14 . The system of claim 11 , wherein the one or more limited-use thresholds limits a number of transactions that can be conducted using the LUK.

15 . The system of claim 11 , wherein the first encryption key is a master derivation key associated with an issuer of an account associated with the account information.

16 . The system of claim 15 , wherein the second encryption key is a unique derivation key for the account.

17 . The system of claim 11 , wherein the first operations further include:

sending an authorization response message with authorization response results to the access device, and wherein the access device displays the authorization response results.

18 . The system of claim 11 , wherein encrypting the account information with the first encryption key to generate the second encryption key includes encrypting the account information using the first encryption key to generate a first portion of the second encryption key, inverting the account information, and encrypting the inverted account information using the first encryption key to generate a second portion of the second encryption key.

19 . The system of claim 11 , wherein encrypting the key index using the second encryption key to generate the LUK includes padding the key index with a first value to generate a first padded key index, encrypting the first padded key index to generate a first portion of the LUK, padding the key index with a second value to generate a second padded key index, and encrypting the second padded key index to generate a second portion of the LUK.

20 . The system of claim 11 , wherein generating the transaction cryptogram includes:

enciphering the transaction data using a first portion of the LUK;

deciphering the enciphered transaction data using a second portion of the LUK; and

re-enciphering the deciphered transaction data using the first portion of the LUK.

Continuity (3)

References Cited (400)