Granted Patent B2

US 12,711,494 · App. 18/376,861 · Granted Aug 18, 2026

Inventors: Mehdi Collinge (Mont-Sainte-Aldegonde, BE); Susan Thompson (Nantwich, GB); Patrik Smets (Nijlen, BE); David Anthony Roberts (Warrington, GB); Michael Christopher Ward (Somerset, GB)

Assignee: MASTERCARD INTERNATIONAL INCORPORATED

G06Q20/3823G06Q20/322G06Q20/385G06Q20/4012G06Q20/405

Abstract

Claims (34)

1 . A method for generating and provisioning payment credentials to a mobile device without the use of a secure element (SE), comprising:

storing, in a database, at least a storage key, a plurality of dynamic card validation code keys, and an application transaction counter associated with a mobile application program;

provisioning, to the mobile device, at least the storage key, an authentication component, and static payment credentials, wherein the static payment credentials are associated with a payment account;

receiving, from the mobile device, a chip authentication program (CAP) token;

validating, by a validation device, the authenticity of the received CAP token;

generating, by a processing device, a session key unpredictable number (KS UN );

generating, by the processing device, a cloud unpredictable number (UN CLOUD );

identifying, by the processing device, an encrypted payload based on a derived dynamic card validation code key (KD CVC3 ), wherein the encrypted payload includes at least a dynamic card validation code key of the plurality of dynamic card validation code keys, the KS UN , and the application transaction counter;

transmitting, by a transmitting device, the encrypted payload to the mobile device for use in generating a dynamic card validation code for use in a financial transaction; and

transmitting, by the transmitting device, at least the KS UN , UN CLOUD , and application transaction counter to an issuer associated with the payment account for use in validating the generated dynamic card validation code used in the financial transaction.

2 . The method of claim 1 , wherein

the KD CVC3 is genuine if the received CAP token is successfully validated, and

the KD CVC3 is fake if the received CAP token is unsuccessfully validated.

3 . The method of claim 1 , wherein validating the authenticity of the CAP token includes validating the authenticity of the CAP token based on at least the provisioned authentication component and an additional credential received from the mobile device.

4 . The method of claim 3 , wherein the additional credential is at least one of: a gesture, a password, a passcode, and a biometric identifier.

5 . The method of claim 1 , wherein validating the authenticity of the CAP token includes validating the authenticity of the CAP token based on at least the application transaction counter.

6 . The method of claim 1 , wherein the encrypted payload is encrypted using at least the storage key.

7 . A system for generating and provisioning payment credentials to a mobile device without the use of a secure element (SE), the system comprising one or more processors and a non-transitory memory storing instructions that, when executed by the one or more processors, cause the one or more processors to:

store, in a database, at least a storage key, a plurality of dynamic card validation code keys, and an application transaction counter associated with a mobile application program;

provision, to the mobile device, at least the storage key, an authentication component, and static payment credentials, wherein the static payment credentials are associated with a payment account;

receive, from the mobile device, a chip authentication program (CAP) token generated based on at least the static payment credentials;

validate the authenticity of the received CAP token;

generate a session key unpredictable number (KS UN );

generate a cloud unpredictable number (UN CLOUD );

identify an encrypted payload based on a derived dynamic card validation code key (KD CVC3 ), wherein the encrypted payload includes at least a dynamic card validation code key of the plurality of dynamic card validation code keys, the KS UN , and the application transaction counter;

transmit the encrypted payload to the mobile device for use in generating a dynamic card validation code for use in a financial transaction; and

transmit at least the KS UN , UN CLOUD , and application transaction counter to an issuer associated with the payment account for use in validating the generated dynamic card validation code used in the financial transaction.

8 . The system of claim 7 , wherein

the KD CVC3 is genuine if the received CAP token is successfully validated, and

the KD CVC3 is fake if the received CAP token is unsuccessfully validated.

9 . The system of claim 7 , further comprising instructions causing the one or more processors to validate the authenticity of the CAP token based on at least the provisioned authentication component and an additional credential received from the mobile device.

10 . The system of claim 9 , wherein the additional credential is at least one of: a gesture, a password, a passcode, and a biometric identifier.

11 . The system of claim 7 , further comprising instructions causing the one or more processors to validate the authenticity of the CAP token based on at least the application transaction counter.

12 . The system of claim 7 , further comprising instructions causing the one or more processors to encrypt the encrypted payload using at least the storage key.

Assignments (1)

Continuity (7)

References Cited (57)