Method for transmitting and processing transaction messages and data processing device

Abstract

A method and a data processing device for transmitting and processing a transaction message are described. The method for transmitting a transaction message involves: generating at least one cryptographic data element at a transaction device using at least a transaction device identifier and further data other than the transaction device identifier as input values ​​of a cryptographic function; and causing a transaction message to be sent to a transaction processing system, the transaction message comprising at least the further data and the at least one cryptographic data element.

Description

[0001] This application is a divisional application of the Chinese national phase application with an international application date of October 26, 2015, an international application number of PCT / GB2015 / 053200, and an invention name of “Transaction Message Sending”. The national phase entry date of the Chinese national phase application is April 21, 2017, the application number is 201580057584.9, and the invention name is “Transaction Message Sending”. Technical Field

[0002] The present invention relates to a system and method for transmitting and processing transaction messages, and in particular, to a system and method for sending a transaction message that encrypts an identifier. Background Art

[0003] Smart devices such as smart cards, access cards, financial instruments such as payment cards, watch pockets and more recently mobile phones and other portable electronic devices are increasingly used to effectuate transactions. Transactions involve a variety of functions. In simple form, a user in possession of a suitable smart device may be granted access through a secure portal. Alternatively, or in addition, such a user may be able to pay for goods and services, or may be able to use the smart device to access a public transport or event at the time of ticket inspection.

[0004] A suitable smart device has a processor and memory. These may be combined in a secure element, a piece of tamper-resistant hardware that can communicate only in a limited way.

[0005] In use, the smart device presents itself as a terminal of a transaction processing system, such as a door lock, point of sale device, or ticket gate. The smart device communicates with the terminal. The communication may be contactless, for example, using near field communication (NFC), or by contact between the device and the terminal. The smart device may communicate only with the terminal; however, data provided by the smart device is more often transmitted to a suitable recipient via the transaction processing system. The recipient authenticates the smart device and responds by, for example, commanding the terminal to open a door or gate, or by providing data to the smart device.

[0006] In order to be able to use smart devices in this manner, the smart devices are provided with a device identifier. The device identifier may be a numeric or alphanumeric string that uniquely identifies the device and thereby enables the transaction processing system to determine whether to authorize access, or effectuate payment, or similar functions. An example of a suitable device identifier for use when making payments is the primary account number or PAN used by credit and debit cards when effectuating payments.

[0007] Methods have been proposed to modify or obfuscate device identifiers during transactions to improve security. Although such proposed systems make it more difficult for malicious third parties to clone or masquerade as smart devices, such systems still do not eliminate the risk of third parties using data transmitted from the device to track the user's movements and activities. Summary of the invention

[0008] According to at least one embodiment, methods, devices, systems, and software are provided to support or implement functions of transmitting and / or processing transaction messages.

[0009] This functionality is achieved by combining the features recited in each independent claim. Accordingly, the dependent claims define further detailed implementations of the various embodiments.

[0010] According to a first aspect of the present invention, a method for transmitting a transaction message is provided, the method comprising: encrypting a transaction device identifier at a transaction device; generating a temporary transaction device identifier at the transaction device; causing the transaction message to be sent to a transaction processing system, the transaction message comprising at least a first data field configured to store the transaction device identifier and a second data field configured to store supplementary data; wherein the temporary transaction device identifier is set in the first data field, and the encrypted transaction device identifier is set in the second data field.

[0011] The temporary transaction device identifier is generated at least in part using further data, the further data being data other than the transaction device identifier. Further, the transaction message may include a third data field, and data identifying at least in part a key associated with encryption of the transaction device identifier is provided in the third data field. The key is generated at least in part using the further data, the further data being data other than the transaction device identifier. Furthermore, the key is further generated using a value uniquely associated with the transaction device identifier.

[0012] The method may include receiving further data from the transaction processing system. For a given transaction, at least a portion of the further data is specific to the transaction.

[0013] In embodiments, the transaction device identifier may include data indicative of a primary account number for the financial instrument.

[0014] According to a second aspect of the present invention, a method for processing a transaction message is provided, the method comprising: receiving a transaction message from a first part of a transaction processing system, the transaction message comprising at least a first data field configured to store a transaction device identifier and a second data field configured to store supplementary data, the first data field comprising a first transaction device identifier; decrypting data in the supplementary data field to identify a second transaction device identifier; and processing the transaction message based on the second transaction device identifier.

[0015] Processing may include sending a modified transaction message to a second portion of the transaction processing system in which the first transaction device identifier is replaced by the second transaction device identifier. The method may further include storing an association between the first transaction device identifier and the second transaction device identifier.

[0016] The method may include: receiving a response message from the second part of the transaction processing system, the response message including a data field configured to store a transaction device identifier, the data field including a second transaction device identifier; modifying the response message to replace the second transaction device identifier with the first transaction device identifier; and sending the modified response message to the first part of the transaction processing system.

[0017] The transaction message may include a third data field, and data at least partially identifying a key associated with encryption of the data in the second data field is disposed in the third data field. In addition, the transaction message may include one or more further data fields configured to store further transaction data, and the method may include: verifying the further transaction data using the data in the third data field.

[0018] The transaction message may include one or more further data fields configured to hold further transaction data, and the method may include generating a key for decrypting data within the second data field from the further transaction data. The method may include further validating the further transaction data using a value uniquely associated with the second transaction device identifier.

[0019] In embodiments, the transaction device identifier may include data indicative of a primary account number for the financial instrument.

[0020] According to a third aspect of the present invention, there is provided a method for transmitting a transaction message, the method comprising: generating at least one cryptographic data element at a transaction device using at least a transaction device identifier and further data other than the transaction device identifier as input values ​​of a cryptographic function; and causing the transaction message to be sent to a transaction processing system, the transaction message comprising at least the further data and at least one cryptographic data element.

[0021] The at least one cryptographic data element may include an encrypted version of the transaction device identifier. Further, the method may include: generating a key using at least the further data; and generating the encrypted version of the transaction device identifier using the key. The method may further include: further, generating the key using a value uniquely associated with the transaction device identifier. The at least one cryptographic data element may further include data at least partially identifying the key.

[0022] In embodiments, the transaction device identifier may include data indicative of a primary account number for the financial instrument.

[0023] According to a fourth aspect of the present invention, a method for processing a transaction message is provided, the method comprising: receiving a transaction message from a first part of a transaction processing system, the transaction message comprising a first transaction device identifier and at least two cryptographic data elements; and using the first of the cryptographic data elements to determine a key; decrypting the second of the cryptographic data elements to thereby determine a second transaction device identifier; and processing the transaction message based on the second transaction device identifier.

[0024] Processing may include sending a modified transaction message to a second portion of the transaction processing system in which the first transaction device identifier is replaced by the second transaction device identifier. The method may further include storing an association between the first transaction device identifier and the second transaction device identifier.

[0025] The method may include: receiving a response message from a second portion of a transaction processing system, the response message including a data field configured to store a transaction device identifier, the data field including a second transaction device identifier; modifying the response message to replace the second transaction device identifier with the first transaction device identifier; and sending the modified response message to the first portion of the transaction processing system.

[0026] The transaction message may include one or more further data fields configured to hold further data, and the method may include: verifying the further data using a first one of the cryptographic data elements. The method may further include: additionally, verifying the further data using a value uniquely associated with the second transaction device identifier.

[0027] In embodiments, the transaction device identifier may include data indicative of a primary account number for the financial instrument.

[0028] According to a fifth aspect of the present invention, a method for processing a transaction message is provided, the method comprising: receiving a transaction message from a first part of a transaction processing system, the transaction message comprising a first transaction device identifier, a cryptographic data element, and further data; generating a key using at least the further data; decrypting the cryptographic data element using the key, thereby determining a second transaction device identifier; and processing the transaction message based on the second transaction device identifier.

[0029] According to a sixth aspect of the present invention, there is provided an apparatus for use in transmitting a transaction message from a transaction device, the apparatus being configured to: encrypt a transaction device identifier; generate a temporary transaction device identifier; and enable the transaction message to be sent to a transaction processing system, the transaction message comprising at least a first data field configured to store the transaction device identifier and a second data field configured to store supplementary data; wherein the temporary transaction device identifier is set in the first data field, and the encrypted transaction device identifier is set in the second data field.

[0030] According to a seventh aspect of the present invention, there is provided an apparatus for processing transaction messages, the apparatus being configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising at least a first data field configured to store a transaction device identifier and a second data field configured to store supplementary data, the first data field comprising a first transaction device identifier; decrypt data within the supplementary data field to identify a second transaction device identifier; and process the transaction message based on the second transaction device identifier.

[0031] According to an eighth aspect of the present invention, there is provided an apparatus for use in transmitting a transaction message from a transaction device, the apparatus being configured to: generate at least one cryptographic data element using at least a transaction device identifier and further data as input values ​​of a cryptographic function; and enable the transaction message to be sent to a transaction processing system, the transaction message comprising at least further data and at least one cryptographic data element.

[0032] According to a ninth aspect of the present invention, there is provided an apparatus for processing a transaction message, the apparatus being configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising a first transaction device identifier and at least two cryptographic data elements; and use a first one of the cryptographic data elements as a key to decrypt a second one of the cryptographic data elements, thereby determining a second transaction device identifier; and process the transaction message based on the second transaction device identifier.

[0033] According to the tenth aspect of the present invention, a device for processing transaction messages is provided, which is configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising a first transaction device identifier, a cryptographic data element, and further data; generate a key using at least the further data; decrypt the cryptographic data element using the key, thereby determining a second transaction device identifier; and process the transaction message based on the second transaction device identifier.

[0034] According to the eleventh aspect of the present invention, there is provided a computer program for use in transmitting a transaction message from a transaction device, the computer program being configured to: encrypt a transaction device identifier; generate a temporary transaction device identifier; and enable the transaction message to be sent to a transaction processing system, the transaction message comprising at least a first data field configured to store the transaction device identifier and a second data field configured to store supplementary data; wherein the temporary transaction device identifier is set in the first data field, and the encrypted transaction device identifier is set in the second data field.

[0035] According to the twelfth aspect of the present invention, a computer program for processing transaction messages is provided, the computer program being configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising at least a first data field configured to store a transaction device identifier and a second data field configured to store supplementary data, the first data field comprising a first transaction device identifier; decrypt the data in the supplementary data field to identify a second transaction device identifier; and process the transaction message based on the second transaction device identifier.

[0036] According to the thirteenth aspect of the present invention, there is provided a computer program for use in transmitting a transaction message from a transaction device, the computer program being configured to: generate at least one cryptographic data element using at least a transaction device identifier and further data as input values ​​of a cryptographic function; and enable the transaction message to be sent to a transaction processing system, the transaction message comprising at least further data and at least one cryptographic data element.

[0037] According to a fourteenth aspect of the present invention, a computer program for processing transaction messages is provided, the computer program being configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising a first transaction device identifier and at least two cryptographic data elements; and use a first one of the cryptographic data elements as a key to decrypt a second one of the cryptographic data elements, thereby determining a second transaction device identifier; and process the transaction message based on the second transaction device identifier.

[0038] According to the fifteenth aspect of the present invention, a computer program for processing transaction messages is provided, the computer program being configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising a first transaction device identifier, a cryptographic data element, and further data; generate a key using at least the further data; decrypt the cryptographic data element using the key, thereby determining a second transaction device identifier; and process the transaction message based on the second transaction device identifier.

[0039] According to the sixteenth aspect of the present invention, there is provided a method for transmitting a transaction message from a transaction device having a transaction device identifier, the method comprising: encrypting the transaction device identifier at the transaction device; generating a transaction message for a transaction system at the transaction device, the transaction message comprising at least a first data field configured to store the transaction device identifier and a second data field configured to store supplementary data; and sending the transaction message to a transaction processing system, wherein generating the transaction message comprises: setting data that does not identify the transaction device in the first data field of the transaction message, and setting the encrypted transaction device identifier in the second data field of the transaction message.

[0040] According to the seventeenth aspect of the present invention, there is provided a method for processing a transaction message, the method comprising: receiving a transaction message from a first part of a transaction processing system, the transaction message comprising at least a first data field configured to store a transaction device identifier and a second data field configured to store supplementary data; decrypting the data in the supplementary data field to generate decrypted data; and processing the transaction message using the decrypted data to form a transaction device identifier instead of (instead of) the data in the first data field.

[0041] According to the eighteenth aspect of the present invention, there is provided an apparatus for use in transmitting a transaction message from a transaction device, the apparatus being configured to: encrypt a transaction device identifier; generate a transaction message comprising at least a first data field configured to store the transaction device identifier and a second data field configured to store supplementary data; and send the transaction message to a transaction processing system; wherein the apparatus is arranged to generate a transaction message so that data that does not identify the transaction device is set in the first data field, and an encrypted transaction device identifier is set in the second data field.

[0042] According to the nineteenth aspect of the present invention, there is provided an apparatus for processing transaction messages, the apparatus being configured to: receive a transaction message from a first part of a transaction processing system, the transaction message comprising at least a first data field configured to store a transaction device identifier and a second data field configured to store supplementary data; decrypt the data in the supplementary data field to generate decrypted data; and process the transaction message using the decrypted data to form a transaction device identifier in place of the data in the first data field.

[0043] Further features and advantages become apparent from the following description of preferred embodiments given by way of example only with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Systems, devices, and methods will now be described as embodiments by way of example only with reference to the accompanying drawings, in which:

[0045] Figure 1 A schematic diagram showing a trading system in which embodiments of the present invention may be practiced;

[0046] Figure 2 shows a communication flow according to an embodiment;

[0047] Figure 3 A method according to an embodiment is shown;

[0048] Figure 4 Another method according to an embodiment is shown; and

[0049] Figure 5A schematic diagram is shown of an apparatus that may be used in embodiments of the present invention.

[0050] Some parts, components and / or steps of the embodiments appear in more than one figure; for clarity, the same reference numerals are used to refer to the same parts, components or steps in all figures. DETAILED DESCRIPTION

[0051] Figure 1 A transaction system 10 is shown. A transaction device 12 is provided. Examples of suitable transaction devices include smart cards, access cards, watch bags, financial instruments such as payment cards, mobile phones, and other portable electronic devices such as tablets and smart watches. The transaction device 12 has a data connection to a transaction terminal 14. Examples of suitable transaction terminals include payment terminals, access points for public transportation systems, and portals.

[0052] The data connection between the transaction device 12 and the transaction terminal 14 is contactless. Examples of contactless connection technologies that can be used include near field communication (NFC) and optical systems, the latter of which can be provided by a system that uses a camera in a mobile phone to recognize and read data presented on, for example, the screen of the terminal. Alternatively, the data connection can be a contact connection using an appropriate arrangement of conductive pads or pins that enable communication.

[0053] The transaction terminal 14 is connected to a first transaction processing server 16, which in turn is connected to a second transaction processing server 18. The terminal 14 together with the servers 16 and 18 may be considered to constitute a transaction processing system 20. Although not shown, one or more additional transaction processing servers may be provided between the transaction terminal 14 and the first transaction processing server 16. Likewise, one or more additional transaction processing servers may be provided between the first transaction processing server 16 and the second transaction processing server 18. In general, the transaction terminal 14 and any additional transaction processing servers between the transaction terminal 14 and the first transaction processing server 16 may be considered a first portion of the transaction processing system 20. Likewise, the second transaction processing server 18 and any additional transaction processing servers between the first transaction processing server 16 and the second transaction processing server 18 may be considered a second portion of the transaction processing system 20.

[0054] Although only a single instance of each device 12, terminal 14, and servers 16 and 18 is shown, it should be appreciated that transaction system 10 may actually be more complex, with multiple devices 12 (representing devices provided to multiple users), multiple terminals 14 (e.g., representing multiple payment terminals or access terminals), and even multiple servers 16 and 18.

[0055] Now refer to Figure 2 describe Figure 1 1 and 2. The operation of the transaction system 10 during a transaction is shown in FIG. In summary, in a transaction, the transaction device 12 is presented to the transaction terminal 14, and the transaction processing system 20 operates to authorize or deny the transaction. Depending on whether the transaction is authorized or denied, the transaction terminal or a device connected thereto may perform some actions (such as opening a portal, etc.), and may alternatively or additionally send a message back to the transaction device. A more detailed description is as follows.

[0056] In a first step 22, a transaction is initiated and the transaction device 12 is connected to the transaction terminal 14. For example, initiating a transaction may include a user selecting goods or services to purchase, or selecting a destination for a ticketing transaction. This may require user input, or alternatively may be predetermined based on the identity of the transaction terminal, for example, using the identity of a transaction terminal on a transportation system to define services that do not require any specific user input.

[0057] The connection between the transaction device 12 and the transaction terminal 14 may be established by presenting the transaction device 12 to the terminal and an already established contactless (e.g., near field communication (NFC)) connection. Alternatively, the transaction device 12 may be physically inserted into or connected to the transaction terminal 14 to enable an electrical connection to be established. This method is known in the art and does not need to be described in detail here.

[0058] In step 24, transaction data associated with the transaction initiated in step 22 and the connection established with the transaction may be sent from the transaction terminal 14 to the transaction device 12. For example, the transaction data may include the price paid at the time of the transaction or the identification of the entry point or exit point of the ticketing transaction on the transportation system. Typically, the nature of the transaction as described above defines the transaction data.

[0059] In step 26, the transaction device prepares a transaction message, and in step 28, the transaction message is sent from the transaction device to the transaction terminal 14. A more detailed description of the message content and the method created in steps 24 to 28 will be referred to below. Figure 3 supply.

[0060] The transaction terminal then forwards the message to the first transaction processing server 16 in step 30. As will be appreciated from the above description, this involves sending the message via one or more further transaction processing servers.

[0061] In step 32, the first transaction processing server 16 processes the transaction message. In some embodiments, the first transaction processing server 16 can authorize or reject the transaction. In this case, the signaling process can proceed directly to step 40 described below.

[0062] Alternatively, the second transaction processing server 18 may be an entity that can authorize or deny a transaction. In this case, the first transaction processing server 16 may modify the message. Then, in step 34, the modified message is sent to the second transaction processing server 18.

[0063] The second transaction processing server 18 then authorizes or denies the transaction and, in step 38, sends a response message to the first transaction processing server 16. In step 40, the response message is again processed by the first transaction processing server 16 before the modified response message is sent to the transaction terminal 14. A more detailed description of the processing of the message by the first transaction processing server 16 in steps 30 to 40 will be referred to below. Figure 4 supply.

[0064] In step 40, upon receipt of the response message, the transaction terminal 14 may then perform any number of actions. For example, the transaction terminal 14 may send a response message to the transaction device 12. The response message may contain data indicating that the transaction is authorized, and, if desired, may include a ticket or other data structure stored by the transaction device 12 for the latter purpose. Alternatively or in addition, the transaction device may take an appropriate action as shown in step 44. For example, the action may be the opening of a door or ticket gate, or may be a provision indicating that the transaction has been authorized to proceed (and therefore the purchased goods or services may be provided to the user).

[0065] The above-described processing flow is known in the technical field of transaction systems, and therefore, is described only in general terms.

[0066] As mentioned above, we will now refer to Figure 3 A more detailed description of the operation of the transaction device in steps 24 to 28 is provided. Here, it is assumed that the transaction device is provided with a transaction device identifier. It is a value or code that enables the transaction processing system to identify the transaction device 12 and distinguish it from other similar transaction devices. An example of a suitable transaction device identifier is the primary account number (PAN) of a financial instrument. In addition to the transaction device identifier, authentication data is stored by the transaction device 12. The authentication data can be used to enable the transaction processing system to authenticate messages sent from the transaction device 12, thereby enabling the transaction processing system to authorize or deny any given transaction. The authentication data may include supplementary credentials and keys previously provided to the transaction device 12.

[0067] As described above, in step 24, the transaction device 12 may receive transaction data from the transaction processing system. The transaction data may include data associated with the identification of the transaction terminal 14, for example, the identification of the business or transportation service provider that provides or uses the terminal, the identification of the terminal itself, the location of the terminal, the channel or domain associated with the communication of the terminal (which may indicate whether wireless or electrical contact is used), and payment details that enable the merchant to receive payment. In addition, the transaction data may include data specific to the transaction itself, for example, data indicating the transaction time, the payment amount, the reduction of the prepaid ticket, and / or the identification of any goods or services associated with the transaction. The transaction data includes at least some data other than the transaction device identifier.

[0068] In step 26A, the transaction device 12 generates a key using the received transaction data. Typically, the key is generated using the transaction data as an input to one or more cryptographic functions. The transaction data may not only be an input to the function, but may also use the following additional input values:

[0069] - a value uniquely associated with the transaction device identifier, for example a hash key or seed value stored on the transaction device 12;

[0070] - transaction device identifier (it is obvious that the transaction data mentioned above represents data other than the transaction device identifier);

[0071] - a value indicating the number of transactions previously performed or completed by transaction device 12; and

[0072] - Data indicating the channel or domain used by the transaction.

[0073] An example of how to generate a key will now be described. This example will use elliptic curve cryptography (ECC) and the so-called ECC E1 Gamal key agreement method. Assume that a cyclic group G is defined based on a generator value g. Based on the group G, a public key P of a transaction processing server (e.g., server 16) is generated. S And generate the server's private key d S .For example:

[0074]

[0075] The transaction device may use the public key. Furthermore, a further key K, ie a hash key, has been defined and is known to the transaction device 12 and the first transaction processing server 16. The hash key K may be a value uniquely associated with the transaction device.

[0076] In a first step, the transaction device 12 calculates a hash value. This may be done using a keyed hash message authentication code (HMAC). The input to the hash function includes a hash key K and, in this example, a device identifier (I D ) and the concatenation of the transaction data. The output of the hash function is represented by h and can be written as:

[0077] h=HMAC(K,I D ||Transaction data)

[0078] The transaction device 12 can generate a transient public key P used by the device during the transaction by using h and the cyclic group G. D The public key P D Represents the above key. For example:

[0079] P D =h·G=g h

[0080] In addition, the transaction device 12 uses h and the public key P of the first transaction processing server 16 S A shared secret S can be generated. For example:

[0081]

[0082] In generating the instantaneous key P D Afterwards, the instantaneous key P D The shared secret S is calculated and in step 26B, the transaction device 12 uses the shared secret S to identify the device identifier I D Encryption is performed to generate an encrypted transaction device identifier C. For example:

[0083] C=enc(S,I D )

[0084] Key P D and the encrypted transaction device identifier C are each considered as cryptographic data elements that can be sent to the transaction terminal 14 in a transaction message.

[0085] In addition to generating the encrypted transaction device identifier C, in step 26C, the transaction device 12 may generate a temporary transaction device identifier. The temporary transaction device identifier may be generated entirely randomly or pseudo-randomly. Alternatively, the temporary transaction device identifier may be based on the encrypted transaction device identifier C; or the temporary transaction device identifier may be generated using further data, at least some of which is data other than the transaction device identifier, for example, the transaction data described above or a public key P generated for the device. D .

[0086] A further function is used to generate a temporary transaction device identifier using one of the above mentioned values ​​as input. For example, typically the device identifier has a specific format, for example, a specific length. In this case, the input value may be modified to provide the temporary transaction device identifier. The temporary transaction device identifier may not be generated in its entirety and is based at least in part on predetermined data, such as a portion of the actual transaction device identifier.

[0087] As an example, where the transaction device identifier is a 16-digit PAN, the first 6 digits represent the bank identification number (BIN) or issuer identification number (IIN), and the last digit represents the check digit. The BIN / IIN from the original transaction device identifier can be maintained and expanded to a temporary transaction device identifier with nine digits and an appropriate check digit.

[0088] In step 26D, the transaction device 12 uses the values ​​generated above to create a transaction message to be sent to the transaction processing system. Typically, the transaction message must comply with certain standards. For example, the transaction message may be formatted according to the EMV standard for payment processing, which specifies indicative data elements of the transaction message, including a data element configured to convey the PAN as a transaction device identifier. Thus, this standard may specify that the message should include at least a first data field configured to store the transaction device identifier and a second data field configured to store supplemental data. Thus, a temporary transaction device identifier that does not actually identify the transaction device 12 may be set in the first data field, and an encrypted transaction device identifier may be set in the second data field. In addition, the transaction message may include a third data field, a key P associated with the encryption of the transaction device identifier. D It should be understood that the key P is not used in the encryption of the transaction device identifier. D Instead, with the public key associated with the shared secret used in encryption, P D Data representing the identification key associated with the encryption of the transaction device identifier.Finally, some or all of the transaction data may be provided in other fields of the message.

[0089] After generating the appropriate transaction message, in step 28 the transaction device 12 sends the transaction message to the transaction processing system, ie the transaction terminal 14 .

[0090] Now refer to Figure 4 A more detailed description of the operation of the first transaction processing server 16 in steps 30 to 40 is provided.

[0091] In step 30, the first transaction processing server 16 receives the transaction message. According to the above description, the message created by the transaction device 12 includes the temporary transaction device identifier, the encrypted transaction device identifier C, and the transient key P D The encrypted transaction device identifier C and the transient key P D Can be considered as a cryptographic data element. In addition, the message may contain at least some transaction data.

[0092] In step 32A, the first transaction processing server 16 may use the key P D Generate a shared secret S. For example:

[0093]

[0094] Then, the encrypted transaction device identifier C can be decrypted using the shared secret S to generate the original transaction device identifier I D .

[0095] In addition, the first transaction processing server 16 can verify any transaction data set in the transaction message. D Query the transaction device 12 for the hash key K and then repeat the process described above for the hash value h′ and the transient public key P′ D Complete this verification. For example:

[0096] h′=HMAC(K,I D ||Transaction data)

[0097] P′ D =h′·G=g h′

[0098] The public key P sent in the transaction message D With the newly generated public key P′ D The comparison proves that the transaction data received in the message corresponds to the generated public key P D Transaction data used when

[0099] The first transaction processing server 16 may then process the transaction message based on the original transaction device identifier (i.e., at least a portion of the decrypted data derived from the encrypted data set in the second data field). In other words, the transaction message may be processed as if the temporary transaction device identifier was replaced by the original transaction device identifier. D As described above, the first transaction processing server 16 itself can authorize or reject the transaction at this time. If this is the case, then in step 32E, the first transaction processing server 16 uses the original transaction device identifier I DDetermine whether to authorize or reject the transaction and generate an appropriate response message. In step 40, the first transaction processing server 16 sends a response message back to the transaction terminal 14.

[0100] However, alternatively, in step 32C, the first transaction processing server 16 may modify the transaction message so as to use the original transaction device identifier I D In addition, in step 32D, the first transaction processing server 16 may store the temporary transaction device identifier and the original transaction device identifier. D The correlation between them.

[0101] Subsequently, in step 34, the first transaction processing server 16 may send the modified transaction message in which the temporary transaction device identifier is replaced with the original transaction device identifier to the second transaction processing server 18. The second transaction processing server 18 then processes the modified transaction message as a normal message initially provided with the unencrypted transaction device identifier.

[0102] In step 36, the first transaction processing server 16 may receive a response message from the second transaction processing server 18. The response message may include a data field configured to store the transaction device identifier. Therefore, the response message includes the original transaction device identifier I D .

[0103] In step 38, the first transaction processing server 16 may modify the response message to replace the original second transaction device identifier I with the first transaction device identifier using the association stored in step 32D. D Then, in step 40 , the modified response message is sent to the transaction terminal 14 .

[0104] The above method provides the following advantages. First, the size of the field designed to contain the transaction device identifier in a typical transaction system is limited and needs to comply with strict formatting rules. This imposes restrictions on the freedom of any temporary transaction device identifier. By setting the temporary transaction device identifier in the message and independently setting the encrypted transaction device identifier, the freedom of encrypting the transaction device identifier is increased, and therefore, security is correspondingly improved. Similarly, since only randomness or pseudo-randomness requirements need to be met and the transaction message can be correctly processed by the transaction system, it is easier to generate a temporary transaction device identifier.

[0105] Furthermore, by providing the ephemeral key to the transaction message, it can be ensured that any information provided in the transaction message cannot be used to track the user. This is because the ephemeral key itself is non-deterministic or random and therefore cannot be used to track the user.

[0106] It should be noted that a system can be used that encrypts the transaction device identifier using only the public key of the recipient server. This system has the disadvantage of being susceptible to attack due to the relatively static key (of the server), i.e. multiple messages, all using the same key, which in turn reduces the security of the system.

[0107] A further advantage relates to the size of the key required to enable efficient encryption of the transaction device identifier. For example, the typical length of an ECC key required to provide adequate encryption is 32 bytes or more. Providing this key in a message takes up a significant amount of the message data, typically significantly more than the transaction device identifier itself. For example, a PAN may be uniquely identified by less than 8 bytes of data, a quarter of the data size of the key that may be used to encrypt the PAN. However, in an embodiment, the key also serves as data that enables authentication of the transaction data. This dual purpose improves the data size efficiency of any message and enables the use of existing systems that have limitations on the size of any message to transmit messages encrypted in accordance with the embodiments described above.

[0108] Alternative embodiments and variations

[0109] Although a specific implementation of an ECC cipher has been described above, it will be appreciated that variations or entirely different systems may be used for the purpose of generating and using keys. For example, the device identifier may be encrypted directly using the shared secret S, however, alternatively, a further key generated by utilizing S may be used. Alternatively, an implementation may use a lattice-based cryptographic approach such as NTRU. For such an implementation, because the output of the encryption mechanism is effectively random, there is no need to communicate a separate transient key to the server.

[0110] In the specific implementation described above, the temporary transaction device identifier is random, so any information in the transaction message cannot be used to track the transaction device 12, and accordingly, cannot potentially track the user of the transaction device 12. Alternatively, instead of a random temporary transaction device identifier, a fixed number stored by the transaction device 12 (the fixed number is the same for many or all transaction devices utilizing the present invention) can be inserted into the field for the transaction device identifier in the transaction message. In this way, the identity of the transaction device cannot be determined from the entry in the transaction device identifier field in the transaction message. Further, such a static transaction device identifier can be used to indicate to the recipient of the transaction message that an encrypted version of the actual transaction device identifier is set in a separate field in the transaction message.

[0111] The embodiments are intended to be compatible with existing systems. Thus, messages sent by the transaction device 12 may conform to existing protocols. Specifically, it is intended that only the transaction device 12 and the first transaction processing server 16 need to be modified so that the entire system can operate as before. Thus, the first transaction processing server 16 may be operable to convert any message provided by the transaction device 12 into a format usable by the second transaction processing server 18 without modifying the second transaction processing server 18.

[0112] In some embodiments, the temporary transaction device identifier may correspond to an encrypted transaction device identifier and may therefore be used to retrieve the original device identifier. This obviates the need for any further fields.

[0113] Although the key has been described as being transmitted via the transaction message, some embodiments may be arranged to generate the key from the transaction data in a manner replicated by the first transaction processing server 16. Accordingly, at the first transaction processing server 16, the key is generated using at least the transaction data provided in the transaction message. The key may then be used to decrypt any cryptographic data element containing the original transaction device identifier.

[0114] In an embodiment, the original transaction device identifier may be a pointer to a transaction device identifier that can be used by the second transaction processing server 18. Therefore, the first transaction processing server 16 may have a lookup table that can use the pointer to identify the identifier of the appropriate transaction device. Therefore, no modification is required for the second transaction processing server 18, and more specifically, the identifier passed between the transaction device 12 and the first transaction server 16 does not need to be selected based on the need for a suitable identifier used by the second transaction processing server 18.

[0115] In the specific implementation described above, the transaction terminal 14 forwards the transaction message from the transaction device 12 to the first transaction processing server 16 and the first transaction processing server 16 recovers the transaction device identifier of the transaction device 12. In some implementations, if the transaction terminal waits for a response from the first transaction processing server, the transaction terminal 14 is required to authorize the transaction faster than can be achieved. An example of this implementation is a ticket gate arrangement, where the transaction terminal in the ticket gate needs to authorize the transaction and pass the ticket information to the transaction device 12 in a short time. In this implementation, the transaction terminal 14 may send a message including the public key authentication of the transaction terminal 14 to the transaction device 12, and the transaction device 12 may encrypt the transaction device identifier using a public key derived or extracted from the authentication of the transaction terminal 14, preferably using the above-mentioned cryptographic scheme, and send the encrypted transaction device identifier to the transaction terminal 14. The transaction terminal 14 may then recover the transaction device identifier and, before authorizing the transaction, for example, compare the recovered transaction device identifier with a blacklist of transaction device identifiers stored by the transaction terminal 14, which indicates which transactions the transaction device 12 should not conduct.

[0116] In embodiments, the transaction device itself may be a self-contained device, such as a smart card or fob, etc. In other embodiments, the transaction device 12 is a general purpose computing device, such as a mobile phone or computer, that contains or is connected to a means for generating a transaction message. The means may be tamper-resistant hardware; i.e., a secure element. In this case, it should be appreciated that references to a transaction message that performs a given operation, such as sending a message to a terminal, represent a transaction device that causes another device (e.g., a mobile phone) to send the message.

[0117] Recently, systems have been proposed for using computing devices (such as mobile phones) without the need for a secure element. This system is known as "host card emulation," whereby transaction applications are run within the device's application processor. An alternative, but similar system uses a "trusted execution environment" that fits within the device. Embodiments of the present invention are applicable to these and similar systems.

[0118] In some embodiments, the transaction device 12 may not receive any transaction data from the transaction terminal 14, but may generate the transaction data itself. In further embodiments, the transaction data is received by other means. For example, it is proposed to use mobile phones when conducting transactions, and to enable these mobile phones to send and receive data via a mobile network and any transactions that occur via a contactless (e.g. NFC) connection between the mobile phone and the terminal. In this case, it is envisaged that in at least some of the communications described above, the provision of transaction data or the transmission of transaction messages by the transaction device does not involve the transaction terminal 14, but involves other communication systems.

[0119] As described above, the connection between the transaction device 12 and the transaction terminal 14 is bidirectional, but is equivalent to unidirectional. For example, a mobile phone may receive transaction data from the terminal via a unidirectional connection (e.g., by photographing a code displayed optically via the terminal) and then create and send a suitable transaction message via a wireless communication network such as a cellular connection or WiFi. In this case, the transaction terminal itself does not have any ability to communicate with the transaction processing network and may be, for example, a poster displaying a fiber optic code such as a QR code.

[0120] In other embodiments, there is no such transaction terminal 14, and the transaction device 12 may communicate directly with the network and thereby with the first transaction processing server 16. This may be used for online transactions where the transaction device 12 is a connected computer or portable device.

[0121] In some implementations, other information such as credentials that enable the message to be authenticated, as well as the device identifier, may be encrypted.

[0122] The key may be compressed. For example, a full instantaneous function key has an X component and a Y component. A key that provides only one or two bits of data of the X component together with a tag indicating the Y component may be compressed. The knowledge of the X component, the function used, and the tag of the Y component enable the selected key to be repeated. In the above description, it should be appreciated that where a key is described as being determined or provided, a compressed version thereof may also be used.

[0123] The transaction device 12, the transaction terminal 14, and the transaction processing servers 16 and 18 may include computerized hardware known in the art. Figure 5 An exemplary computerized system 50 capable of performing the method steps described above is described.

[0124] The computerized system 50 includes a processing system 51, such as a CPU or a CPU array. The processing system 51 is connected to a computer-readable storage medium, such as a memory 52. ​​The memory can be a volatile memory, such as RAM; or a non-volatile or non-transitory memory, such as a solid state drive (SSD) or a hard disk drive (HDD). The system 50 may also include an interface 54 capable of sending and / or receiving data from other elements in the system.

[0125] The memory 52 stores computer readable / computer-executable instructions 53. The computer readable instructions can be configured so that when executed by the processing system 51, the computer system 50 is caused to perform the method described above. To this end, the processing system 51 can retrieve the computer instructions 53 from the memory 52 and execute these instructions. Therefore, the processing system 51 can cause the interface to send or receive data as needed. The data itself is stored in the memory 52 and retrieved as needed, for example, to be sent via the interface 54.

[0126] It should be understood that any feature described in relation to any one embodiment may be used alone or in combination with the other features described, and may also be used in combination with one or more features of any other embodiment, or any combination of any other embodiment. Further, equivalents and variations not described above may also be employed without departing from the scope of the invention. Features in the claims may be combined with features other than those specified in the claims.

Claims

1. A method for transmitting a transaction message from a transaction device having a transaction device identifier to a transaction processing system, the transaction processing system comprising a transaction processing server, the method comprising: At the transaction device, a hash value h is calculated by inputting a hash key K known to the transaction device and the transaction processing server and a concatenation of the transaction device identifier and the transaction data of the transaction; At the transaction device, using the hash value h and the cyclic group G to generate an ephemeral public key for use by the transaction device in a transaction; At the transaction device, generating a shared secret using the hash value h and a transaction server public key of the transaction processing server; At the transaction device, encrypting the transaction device identifier using the shared secret; generating, at the transaction device, a transaction message for the transaction processing system, wherein the transaction message is formatted in accordance with the EMV standard and includes a plurality of data fields, the plurality of data fields including a first data field designated in accordance with the EMV standard for storing the transaction device identifier and a second data field designated in accordance with the EMV standard for storing supplemental data, Wherein, generating the transaction message includes: setting a temporary transaction device identifier that does not identify the transaction device in the first data field of the transaction message, placing an encrypted transaction device identifier in the second data field of the transaction message, and placing the transient public key of the transaction device in a third data field of the transaction message, The transaction data is set in other fields of the transaction message, The transaction message is sent to the transaction processing system to i) recreate the shared secret using the ephemeral public key of the transaction device in the third data field and a transaction server private key corresponding to the transaction server public key; ii) decrypt the encrypted transaction device identifier located in the second data field using the shared secret; and iii) verify the received transaction data using the decrypted transaction device identifier.

2. The method according to claim 1, wherein: The transaction device identifier includes data indicative of a primary account number for a financial instrument.

Images