Systems, methods, and computer program products for authenticating users that engage in transactions

Abstract

A system, method, and computer program product for authenticating a user for a transaction: generating an electronic wallet key pair, the electronic wallet key pair including an electronic wallet public key and a corresponding electronic wallet private key, the electronic wallet key pair associated with an electronic wallet transaction processing system; receiving a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key associated with a payment gateway system; generating a public re-encryption key based on the payment gateway public key; communicating the public re-encryption key to the payment gateway system; receiving or determining encrypted transaction data associated with a transaction, the encrypted transaction data including an account identifier encrypted with the electronic wallet public key; re-encrypting the encrypted transaction data with the public re-encryption key; and communicating the re-encrypted transaction data to the payment gateway system.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. application No. 16 / 540,230, filed August 14, 2019, the entire contents of which are incorporated herein by reference. Background Art 1. Technical Field

[0004] The present disclosure relates generally to systems, apparatus, products, devices, and methods for user authentication and, in some non-limiting embodiments or aspects, to a method, system, and product for authenticating a user conducting a transaction using re-encryption.

[0005] 2. Technical Considerations

[0006] When two parties share data through an untrusted intermediary, a data flow loop problem may occur. For example, verifying users who conduct transactions through an e-wallet transaction processing system may encounter a data flow loop problem because the e-wallet transaction processing system may send data to the payment gateway via the merchant's system. For example, consumers who use e-wallets to conduct transactions may experience increased transaction processing times (e.g., increased checkout times, etc.). In addition, payment gateways and e-wallets may be subject to integration burdens and operational overhead, which may inhibit user verification and / or further increase transaction processing times. Therefore, there is a need for improved user verification for transactions. Summary of the Invention

[0007] Thus, improved systems, apparatus, products, devices and / or methods are provided for authenticating users conducting transactions.

[0008] According to some non-limiting embodiments or aspects, there is provided a computer-implemented method comprising: generating, with an e-wallet transaction processing system, an e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair being associated with the e-wallet transaction processing system; receiving, with the e-wallet transaction processing system, a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generating, with the e-wallet transaction processing system, a public re-encryption key based on the payment gateway public key; transmitting the public re-encryption key from the e-wallet transaction processing system to the payment gateway system; receiving or determining, with the e-wallet transaction processing system, encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier encrypted with the e-wallet public key; re-encrypting, with the e-wallet transaction processing system, the encrypted transaction data with the public re-encryption key; and transmitting the re-encrypted transaction data from the e-wallet transaction processing system to the payment gateway system.

[0009] In some non-limiting embodiments or aspects, the method further comprises: receiving, with the e-wallet transaction processing system, a user credential associated with a user that initiated the transaction; and verifying, with the e-wallet transaction processing system, the user that initiated the transaction based on the user credential, wherein verifying the user that initiated the transaction comprises: re-encrypting the encrypted transaction data with the public re-encryption key and transmitting the re-encrypted transaction data to the payment gateway system.

[0010] In some non-limiting embodiments or aspects, the e-wallet transaction processing system verifies the user that initiated the transaction based on the user credential without decrypting the encrypted transaction data comprising the account identifier encrypted with the e-wallet public key.

[0011] In some non-limiting embodiments or aspects, the method further comprises: storing, with the e-wallet transaction processing system, the account identifier associated with the user credential encrypted with the e-wallet public key in an in-memory database.

[0012] In some non-limiting embodiments or aspects, the e-wallet transaction processing system transmits the re-encrypted transaction data to the payment gateway system via a merchant system.

[0013] In some non-limiting embodiments or aspects, the e-wallet transaction processing system receives the user credential associated with the user that initiated the transaction from the merchant system.

[0014] In some non-limiting embodiments or aspects, the method further comprises: receiving, with the payment gateway system, the re-encrypted transaction data; decrypting, with the payment gateway system, the re-encrypted transaction data based at least in part on the payment gateway private key; and identifying, with the payment gateway, the account identifier.

[0015] According to some non-limiting embodiments or aspects, a system is provided, comprising: an e-wallet transaction processing system comprising one or more processors programmed and / or configured to: generate an e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair being associated with the e-wallet transaction processing system; receive a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generate a public re-encryption key based on the payment gateway public key; transmit the public re-encryption key to the payment gateway system; receive or determine encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier encrypted with the e-wallet public key; re-encrypt the encrypted transaction data with the public re-encryption key; and transmit the re-encrypted transaction data to the payment gateway system.

[0016] In some non-limiting embodiments or aspects, the e-wallet transaction processing system comprising the one or more processors is further programmed and / or configured to: receive user credentials associated with a user that initiated the transaction; and verify the user that initiated the transaction based on the user credentials, wherein verifying the user that initiated the transaction comprises: re-encrypting the encrypted transaction data with the public re-encryption key, and transmitting the re-encrypted transaction data to the payment gateway system.

[0017] In some non-limiting embodiments or aspects, the e-wallet transaction processing system comprising the one or more processors verifies the user that initiated the transaction based on the user credentials without decrypting the encrypted transaction data comprising the account identifier encrypted with the e-wallet public key.

[0018] In some non-limiting embodiments or aspects, the e-wallet transaction processing system comprising the one or more processors is further programmed and / or configured to: store the account identifier associated with the user credentials encrypted with the e-wallet public key in an in-memory database.

[0019] In some non-limiting embodiments or aspects, the e-wallet transaction processing system including the one or more processors transmits the re-encrypted transaction data to the payment gateway system via a merchant system.

[0020] In some non-limiting embodiments or aspects, the e-wallet transaction processing system including the one or more processors receives the user credentials associated with the user that occurred the transaction from the merchant system.

[0021] In some non-limiting embodiments or aspects, the system further includes the payment gateway system including one or more processors programmed and / or configured to: receive the re-encrypted transaction data; decrypt the re-encrypted transaction data based at least in part on the payment gateway private key; and identify the account identifier.

[0022] According to some non-limiting embodiments or aspects, a computer program product includes at least one non-transitory computer-readable medium containing program instructions that, when executed by at least one processor, cause the at least one processor to: generate an e-wallet key pair including an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair being associated with an e-wallet transaction processing system; receive a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generate a public re-encryption key based on the payment gateway public key; transmit the public re-encryption key to the payment gateway system; receive or determine encrypted transaction data associated with a transaction, the encrypted transaction data including an account identifier encrypted with the e-wallet public key; re-encrypt the encrypted transaction data with the public re-encryption key; and transmit the re-encrypted transaction data to the payment gateway system.

[0023] In some non-limiting embodiments or aspects, the instructions further cause the at least one processor to: receive user credentials associated with a user that occurred the transaction; and verify the user that occurred the transaction based on the user credentials, wherein verifying the user that occurred the transaction includes: re-encrypting the encrypted transaction data with the public re-encryption key, and transmitting the re-encrypted transaction data to the payment gateway system.

[0024] In some non-limiting embodiments or aspects, the instructions cause the at least one processor to verify the user that occurred the transaction based on the user credentials without decrypting the encrypted transaction data including the account identifier encrypted with the e-wallet public key.

[0025] In some non-limiting embodiments or aspects, the instructions further cause the at least one processor to: store the account identifier associated with the user credential encrypted with the e-wallet public key in an in-memory database.

[0026] In some non-limiting embodiments or aspects, the instructions further cause the at least one processor to: transmit, via a merchant system, the re-encrypted transaction data to the payment gateway system; and receive, from the merchant system, the user credential associated with the user that occurred the transaction.

[0027] In some non-limiting embodiments or aspects, the instructions further cause the at least one processor to: receive the re-encrypted transaction data; decrypt the re-encrypted transaction data based at least in part on the payment gateway private key; and identify the account identifier.

[0028] Other non-limiting embodiments or aspects are set forth in the following numbered clauses:

[0029] Clause 1. A computer-implemented method comprising: generating, with an e-wallet transaction processing system, an e-wallet key pair, the e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair being associated with the e-wallet transaction processing system; receiving, with the e-wallet transaction processing system, a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generating, with the e-wallet transaction processing system, a public re-encryption key based on the payment gateway public key; transmitting the public re-encryption key from the e-wallet transaction processing system to the payment gateway system; receiving or determining, with the e-wallet transaction processing system, encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier encrypted with the e-wallet public key; re-encrypting, with the e-wallet transaction processing system, the encrypted transaction data with the public re-encryption key; and transmitting re-encrypted transaction data from the e-wallet transaction processing system to the payment gateway system.

[0030] Clause 2. The computer-implemented method of clause 1, further comprising: receiving, with the e-wallet transaction processing system, user credentials associated with a user that initiated the transaction; and verifying, with the e-wallet transaction processing system, the user that initiated the transaction based on the user credentials, wherein verifying the user that initiated the transaction comprises: re-encrypting, with the public re-encryption key, the encrypted transaction data, and communicating the re-encrypted transaction data to the payment gateway system.

[0031] Clause 3. The computer-implemented method of clause 1 or 2, wherein the e-wallet transaction processing system verifies the user that initiated the transaction based on the user credentials without decrypting the encrypted transaction data that includes the account identifier encrypted with the e-wallet public key.

[0032] Clause 4. The computer-implemented method of any of clauses 1-3, further comprising: storing, with the e-wallet transaction processing system, the account identifier associated with the user credentials encrypted with the e-wallet public key in an in-memory database.

[0033] Clause 5. The computer-implemented method of any of clauses 1-4, wherein the e-wallet transaction processing system communicates the re-encrypted transaction data to the payment gateway system via a merchant system.

[0034] Clause 6. The computer-implemented method of any of clauses 1-5, wherein the e-wallet transaction processing system receives the user credentials associated with the user that initiated the transaction from the merchant system.

[0035] Clause 7. The computer-implemented method of any of clauses 1-6, further comprising: receiving, with the payment gateway system, the re-encrypted transaction data; decrypting, with the payment gateway system, the re-encrypted transaction data based at least in part on the payment gateway private key; and identifying, with the payment gateway, the account identifier.

[0036] Clause 8. A system comprising: an e-wallet transaction processing system comprising one or more processors programmed and / or configured to: generate an e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair being associated with the e-wallet transaction processing system; receive a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generate a public re-encryption key based on the payment gateway public key; communicate the public re-encryption key to the payment gateway system; receive or determine encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier encrypted with the e-wallet public key; re-encrypt the encrypted transaction data with the public re-encryption key; and communicate the re-encrypted transaction data to the payment gateway system.

[0037] Clause 9. The system of clause 8, wherein the e-wallet transaction processing system comprising the one or more processors is further programmed and / or configured to: receive user credentials associated with a user that initiated the transaction; and verify the user that initiated the transaction based on the user credentials, wherein verifying the user that initiated the transaction comprises re-encrypting the encrypted transaction data with the public re-encryption key and communicating the re-encrypted transaction data to the payment gateway system.

[0038] Clause 10. The system of clause 8 or 9, wherein the e-wallet transaction processing system comprising the one or more processors verifies the user that initiated the transaction based on the user credentials without decrypting the encrypted transaction data comprising the account identifier encrypted with the e-wallet public key.

[0039] Clause 11. The system of any one of clauses 8 to 10, wherein the e-wallet transaction processing system comprising the one or more processors is further programmed and / or configured to: store the account identifier associated with the user credentials encrypted with the e-wallet public key in an in-memory database.

[0040] Clause 12. The system of any one of clauses 8 to 11, wherein the e-wallet transaction processing system comprising the one or more processors communicates the re-encrypted transaction data to the payment gateway system via a merchant system.

[0041] Clause 13. The system of any of clauses 8 to 12, wherein the e-wallet transaction processing system comprising the one or more processors receives the user credentials associated with the user that occurred the transaction from the merchant system.

[0042] Clause 14. The system of any of clauses 8 to 13, further comprising: the payment gateway system comprising one or more processors programmed and / or configured to: receive the re-encrypted transaction data; decrypt the re-encrypted transaction data based at least in part on the payment gateway private key; and identify the account identifier.

[0043] Clause 15. A computer program product comprising at least one non-transitory computer- readable medium containing program instructions, the program instructions, when executed by at least one processor, cause the at least one processor to: generate an e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair associated with the e-wallet transaction processing system; receive a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key associated with a payment gateway system; generate a public re-encryption key based on the payment gateway public key; communicate the public re-encryption key to the payment gateway system; receive or determine encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier encrypted with the e-wallet public key; re-encrypt the encrypted transaction data with the public re-encryption key; and communicate the re-encrypted transaction data to the payment gateway system.

[0044] Clause 16. The computer program product of clause 15, wherein the instructions further cause the at least one processor to: receive user credentials associated with a user that occurred the transaction; and verify the user that occurred the transaction based on the user credentials, wherein verifying the user that occurred the transaction comprises: re-encrypting the encrypted transaction data with the public re-encryption key and communicating the re-encrypted transaction data to the payment gateway system.

[0045] Clause 17. The computer program product of clause 15 or 16, wherein the instructions cause the at least one processor to verify the user that occurred the transaction based on the user credentials without decrypting the encrypted transaction data comprising the account identifier encrypted with the e-wallet public key.

[0046] Clause 18. The computer program product of any of clauses 15 to 17, wherein the instructions further cause the at least one processor to: store the account identifier associated with the user credential encrypted with the electronic wallet public key in an in-memory database.

[0047] Clause 19. The computer program product of any of clauses 15 to 18, wherein the instructions cause the at least one processor to: transmit, via a merchant system, the re-encrypted transaction data to the payment gateway system; and receive, from the merchant system, the user credential associated with the user that occurred the transaction.

[0048] Clause 20. The computer program product of any of clauses 15 to 19, wherein the instructions further cause the at least one processor to: receive the re-encrypted transaction data; decrypt the re-encrypted transaction data based at least in part on the payment gateway private key; and identify the account identifier.

[0049] These and other features and characteristics of the present disclosure, as well as the methods of operation and functions of the related elements of structure and the combination of parts and economies of manufacture, will become more apparent upon consideration of the following description and appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals designate corresponding parts in the various figures. It is to be expressly understood, however, that the drawings are for purposes of illustration only and are not intended as a definition of the limits of the disclosure. As used in the specification and in the claims, the singular form of "a", "an", and "the" include plural referents unless the context clearly dictates otherwise. BRIEF DESCRIPTION OF DRAWINGS

[0050] Additional advantages and details of implementation will now be described in greater detail below with reference to exemplary embodiments or aspects illustrated in the drawings, wherein:

[0051] Figure 1 is a signal flow diagram of an existing implementation of a process for authenticating a user that occurred a transaction;

[0052] Figure 2 is a diagram of a non-limiting embodiment or aspect of an environment in which the systems, apparatuses, products, devices, and / or methods described herein can be implemented;

[0053] Figure 3 is a diagram of a non-limiting embodiment or aspect of one or more apparatuses and / or components of one or more systems of Figure 2 ; and

[0054] Figure 4 is a flow diagram of a non-limiting embodiment or aspect of a process for authenticating a user that occurred a transaction;

[0055] Figure 5 is a signal flow diagram of an implementation of a non-limiting embodiment or aspect of a process for authenticating a user who is transacting; and

[0056] Figure 6 is a signal flow diagram of an implementation of a non-limiting embodiment or aspect of a process for authenticating a user who is transacting. DETAILED DESCRIPTION

[0057] It should be understood that the disclosure can employ various alternative changes and step orders, except as explicitly specified herein. It should also be understood that the particular implementations shown in the attached drawings, and described herein, are merely exemplary and non-limiting embodiments or aspects. Thus, the specific dimensions and other physical characteristics related to the embodiments or aspects disclosed herein are not to be considered as limiting.

[0058] No aspect, component, element, structure, act, step, function, instruction, etc. used herein should be understood as critical or essential unless explicitly described as such. Also, as used herein, the articles "a" and "an" are intended to include one or more items, and can be used interchangeably with "one or more" and "at least one." Furthermore, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, a combination of related and unrelated items, etc.), and can be used interchangeably with "one or more" or "at least one." Where only one item is intended, the term "one" or similar language is used. Also, as used herein, the terms "has," "have," "having," or the like are intended to be open-ended terms. Further, the phrase "based on" is intended to mean "based, at least in part, on" unless explicitly stated otherwise.

[0059] As used herein, the terms "communication" and "communicate" refer to the receipt or the transfer of one or more signals, messages, commands, or other type of data. For one unit (e.g., any device, system, or component thereof) to be in communication with another unit means that the one unit is able to directly or indirectly receive data from and / or transmit data to the other unit. This can refer to a direct or indirect connection, either wired and / or wireless in nature, between the one unit and the other unit. Additionally, two units can be in communication with each other even though the data transmitted can be modified, processed, relayed and / or routed through another unit. For example, a first unit can be in communication with a second unit even though the data transmitted can be modified, processed, relayed and / or routed through another unit. As another example, a first unit can be in communication with a second unit if the first unit transmits data to the second unit, even if the second unit does not actively receive or transmit data to the first unit. It will be appreciated that many other arrangements are possible.

[0060] It will be apparent to those skilled in the art that the systems and / or methodologies described herein can be implemented in different forms of hardware, software, or combinations thereof. The actual specialized control hardware or software code used to implement these systems and / or methodologies is not limiting of the implementations. Thus, the operation and behavior of the systems and / or methodologies were described herein without reference to specific software code — it being understood that software and hardware can be designed to implement the systems and / or methodologies based on the description herein.

[0061] Some non-limiting embodiments or aspects are described herein in connection with a threshold value. As used herein, satisfying a threshold value can refer to a value that is greater than the threshold value, more than the threshold value, higher than the threshold value, greater than or equal to the threshold value, less than the threshold value, fewer than the threshold value, lower than the threshold value, less than or equal to the threshold value, equal to the threshold value, and / or the like.

[0062] As used herein, the term "transaction service provider" can refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment guarantees through an agreement between the transaction service provider and an issuer institution. The terms "transaction service provider" and "transaction service provider system" can also refer to one or more computer systems operated by or on behalf of a transaction service provider, such as a transaction processing system that executes one or more software applications. The transaction processing system can include one or more server computers having one or more processors, and in some non-limiting embodiments or aspects, the transaction processing system can be operated by or on behalf of a transaction service provider.

[0063] As used herein, the term“account identifier” can include one or more primary account numbers (PANs), tokens, or other identifiers (e.g., globally unique identifiers (GUIDs), universally unique identifiers (UUIDs), etc.) associated with a customer account of a user (e.g., a customer, a consumer, etc.). The term“token” can refer to an identifier that is used as a substitute or replacement identifier for a PAN or other original account identifier. An account identifier can be alphanumeric, or any combination of characters and / or symbols. A token can be associated with a PAN or other original account identifier in one or more databases such that a transaction can be conducted using the token without directly using the original account identifier. In some instances, an original account identifier, such as a PAN, can be associated with multiple tokens for different individuals or purposes.

[0064] As used herein, the term“issuer institution,”“portable financial device issuer,”“issuer,” or“issuer bank” can refer to one or more entities that provide one or more accounts to a user (e.g., a customer, a consumer, an organization, etc.) for conducting transactions (e.g., payment transactions), such as initiating credit card payment transactions and / or debit card payment transactions. For example, an issuer institution can provide an account identifier, such as a PAN, to a user that uniquely identifies one or more accounts associated with the user. An account identifier can be embodied on a portable financial device, such as a physical financial instrument (e.g., a payment card), and / or can be electronic and used for electronic payments. In some non-limiting embodiments or aspects, an issuer institution can be associated with a bank identification number (BIN) that uniquely identifies the issuer institution. As used herein, an“issuer institution system” can refer to one or more computer systems operated by or on behalf of an issuer institution, such as a server computer executing one or more software applications. For example, an issuer institution system can include one or more authorization servers for authorizing payment transactions.

[0065] As used herein, the term“merchant” can refer to an individual or entity that provides products and / or services or access to products and / or services to a customer based on a transaction, such as a payment transaction. The term“merchant” or“merchant system” can also refer to one or more computer systems operated by or on behalf of a merchant, such as a server computer executing one or more software applications. As used herein, a“point-of-sale (POS) system” can refer to one or more computers and / or peripheral devices used by a merchant to conduct payment transactions with a customer, including one or more card readers, near-field communication (NFC) receivers, RFID receivers, and / or other contactless transceivers or receivers, contact-based receivers, payment terminals, computers, servers, input devices, and / or other similar devices that can be used to initiate payment transactions.

[0066] As used herein, the term "mobile device" can refer to one or more portable electronic devices configured to communicate with one or more networks. For example, a mobile device can include a cellular phone (e.g., a smart phone or a standard cellular phone), a portable computer (e.g., a tablet computer, a laptop computer, etc.), a wearable device (e.g., a watch, glasses, lenses, clothing, etc.), a personal digital assistant (PDA), and / or other similar devices. As used herein, the terms "client device" and "user device" refer to any electronic device configured to communicate with one or more servers or remote devices and / or systems. A client device or user device can include a mobile device, a network-enabled appliance (e.g., a network-enabled television, a refrigerator, a thermostat, etc.), a computer, a POS system, and / or any other device or system capable of communicating with a network.

[0067] As used herein, the term "computing device" or "computer device" can refer to one or more electronic devices configured to communicate directly or indirectly with one or more networks or over one or more networks. A computing device can be a mobile device, a desktop computer, etc. Further, the term "computer" can refer to any computing device that includes the necessary components for receiving, processing, and outputting data, and typically includes a display, a processor, a memory, an input device, and a network interface. An "application" or "application programming interface" (API) refers to computer code or other data ordered on a computer-readable medium that can be executed by a processor to facilitate interaction between software components, such as the interaction of a client-side front-end and / or a server-side back-end for receiving data from a client. An "interface" refers to a generated display, such as one or more graphical user interfaces (GUIs) that a user can directly or indirectly interact with, e.g., through a keyboard, mouse, touch screen, etc.

[0068] As used herein, the terms "e-wallet" and "e-wallet application" refer to one or more electronic devices and / or software applications configured to initiate and / or conduct payment transactions. For example, an e-wallet can include a mobile device executing an e-wallet application, and can also include server-side software and / or databases for maintaining and providing transaction data to the mobile device. An "e-wallet provider" can include an entity that provides and / or maintains an e-wallet for a customer, such as Google Android Apple Samsung and / or other similar electronic payment systems. In some non-limiting examples, an issuer bank can be an e-wallet provider.

[0069] As used herein, the term“electronic wallet transaction processing system” can refer to one or more electronic devices and / or software applications configured to process and / or request verification of a user conducting a transaction initiated and / or performed by an electronic wallet application. For example, an electronic wallet transaction processing system can include server-side software and / or databases for maintaining transaction data and / or account data and providing the transaction data and / or account data to merchant systems and / or payment gateway systems for processing and / or verification of a user conducting an electronic wallet transaction. An“electronic wallet transaction processing system provider” can include an entity that provides and / or maintains an electronic wallet transaction processing system, such as Visa Mastercard Checkout and / or other similar electronic wallet transaction processing system providers. In some non-limiting examples, a transaction service provider system can be an electronic wallet transaction processing system.

[0070] As used herein, the term“account data” refers to any data related to one or more accounts of one or more users. Account data can include, for example, one or more account identifiers, user identifiers, transaction history, balance, credit line, issuer institution identifier, and / or the like.

[0071] As used herein, the term“portable financial device” or“payment device” can refer to, for example, an electronic payment device, a payment card (e.g., a credit or debit card), a gift card, a smart card, a smart media, a payroll card, a health care card, a wristband, a machine-readable medium containing account information, a keychain device or accessory, an RFID transponder, a retailer discount or rewards card, a mobile device executing an electronic wallet application, a PDA, a security card, an access card, a wireless terminal, and / or transponder. A portable financial device can include volatile or non-volatile memory for storing information such as an account identifier and / or an account holder name.

[0072] As used herein, the term“server” can refer to or include one or more processors or computers, storage devices, or similar computer arrangements operated by or facilitating communication and processing by multiple parties in a network environment such as the Internet, although it will be appreciated that communication can be facilitated by one or more public or private network environments, and various other arrangements are possible. Further, multiple computers (e.g., servers) or other computerized devices (such as POS devices) in direct or indirect communication in a network environment can constitute a“system,” such as a POS system of a merchant.

[0073] As used herein, the term “acquirer” can refer to an entity licensed by and / or approved by a transaction service provider to initiate transactions using the transaction service provider’s portable financial devices. An acquirer can also refer to one or more computer systems operated by or on behalf of an acquirer, such as a server computer executing one or more software applications (e.g., an “acquirer server”). An “acquirer” can be a merchant bank, or in some cases, a merchant system can be an acquirer. The transactions can include original credit transactions (OCTs) and account funding transactions (AFTs). An acquirer can be authorized by a transaction service provider to sign up merchants of the service provider to initiate transactions using the transaction service provider’s portable financial devices. An acquirer can contract with a payment service provider to enable the service provider to sponsor merchants. An acquirer can monitor the compliance of a payment service provider in accordance with the regulations of a transaction service provider. An acquirer can conduct due diligence on a payment service provider and ensure proper due diligence is conducted prior to signing up a sponsored merchant. An acquirer can be liable for all transaction service provider programs they operate or sponsor. An acquirer can be liable for the actions of its payment service providers and its or its payment service providers’ sponsored merchants.

[0074] As used herein, the term “payment gateway” can refer to an entity and / or a payment processing system operated by or on behalf of such an entity (e.g., a merchant service provider, a payment service provider, a payment service broker, a payment service broker contracted with an acquirer, a payment aggregator, etc.) that provides payment services (e.g., transaction service provider payment services, payment processing services, etc.) to one or more merchants. The payment services can be associated with the use of portable financial devices managed by a transaction service provider. As used herein, the term “payment gateway system” can refer to one or more computer systems, computer devices, servers, groups of servers, etc. operated by or on behalf of a payment gateway.

[0075] As used herein, the term“3D Secure provider” can refer to an entity that receives transaction data and / or account data such as account identifiers from a payment gateway or other entity and provides an additional layer of security for electronic transactions. For example, a 3D Secure provider can enable a consumer to self- authenticate with their card issuer when making a card not present (CNP) e-commerce purchase with the additional layer of security, which helps to deter or prevent unauthorized CNP transactions (card not present transactions) and protects merchants from CNP fraud. The term“3D Secure provider system” can also refer to one or more computer systems operated by or on behalf of a 3D Secure provider, such as a 3D Secure server executing one or more software applications. A 3D Secure server can include one or more processors and, in some non-limiting embodiments or aspects, can be operated by or on behalf of a 3D Secure provider. A 3D Secure provider can include any entity that operates a 3D Secure server, such as / Visa Mastercard JCB International J / Secure, American Express or any other entity that provides an additional layer of security for electronic transactions.

[0076] Improved systems, apparatuses, products, devices, and / or methods for authenticating a user making a transaction are provided.

[0077] As previously discussed, a data flow loop problem can occur when two parties share data via an untrusted intermediary. For example, to authenticate a user or payor making an e-wallet transaction, an e-wallet transaction processing system can send a PAN associated with the user to a payment gateway via a merchant system with which the user initiated or is making the e-wallet transaction. Referring now to Figure 1 , Figure 1 is a signal flow diagram of a prior implementation 100 of a process for authenticating a user making a transaction. As Figure 1As shown in FIG. 1, at reference numeral 150, the merchant system 104 can receive user credentials (e.g., a username, a password, etc.) from the user device 102 for initiating or conducting an e-wallet transaction (e.g., for a consumer to check out on a merchant website using e-wallet credentials, etc.). At reference numeral 152, the merchant system 104 can securely transmit (e.g., by encrypting the user credentials with a public key, etc.) the user credentials to the e-wallet transaction processing system 106 (e.g., for requesting verification of the user transacting, etc.). At reference numeral 154, the e-wallet transaction processing system 106 can verify the user transacting by checking or matching the user credentials against a user credentials database (e.g., using a verification API 106a, etc.). At reference numeral 156, after successful verification of the user transacting, the e-wallet transaction processing system 106 can transmit a unique random ID associated with the transaction to the payment gateway 108 via the merchant system 104. For example, the merchant system 104 can receive the unique random ID and forward the unique random ID to the payment gateway system 108 at reference numeral 158. At reference numeral 160, the payment gateway 108 transmits a request for a PAN associated with the user transacting. The e-wallet transaction processing system 106 and the payment gateway 108 can exchange and / or store an authorization API key and / or a digital signature associated with the payment gateway as credentials for verifying the payment gateway 108 for requesting the PAN associated with the user transacting prior to processing the transaction. At reference numeral 162, the e-wallet transaction processing system 106 verifies the payment gateway 108 for the request for the PAN associated with the user’s e-wallet (e.g., at the verification API 106a, etc.) and forwards the request to a PAN data API 106b for retrieval of the PAN. At reference numeral 164, the e-wallet transaction processing system 106 (e.g., the PAN data API 106b, etc.) retrieves encrypted PAN data associated with the user’s e-wallet. At reference numeral 166, the e-wallet transaction processing system 106 (e.g., the PAN data API 106b, etc.) decrypts the encrypted PAN data using a hardware security module (HSM) to retrieve the PAN associated with the user’s e-wallet. At reference numeral 168, the e-wallet transaction processing system 106 encrypts the PAN associated with the user’s e-wallet with a payment gateway public key and transmits the encrypted PAN to the payment gateway 108. At reference numeral 170, the payment gateway 108 decrypts the encrypted PAN using a payment gateway key corresponding to the payment gateway public key. At reference numeral 172, the payment gateway 108 transmits data associated with the PAN (e.g., the PAN, a BIN of the PAN, etc.) to the 3D secure provider system 110 for further user verification and transaction authorization.

[0078] In this manner, existing processes for authenticating a user transacting a transaction can: (i) rely on HSM processing during processing of the transaction, which can result in longer transaction processing times (e.g., slower e-wallet checkout speeds, etc.) and increased operational overhead, and (ii) use multiple communications between the e-wallet transaction processing system 106 and the payment gateway 108 (e.g., foreign wallet integrations, additional network inputs / outputs, etc.), which can also result in longer transaction processing times or slower e-wallet checkout speeds. Accordingly, existing processes for authenticating a user transacting a transaction can be inefficient and time consuming, thereby resulting in increased checkout processing times.

[0079] Non-limiting embodiments or aspects of the present disclosure relate to systems, methods, and computer program products for authenticating a user transacting a transaction that generate an e-wallet key pair, the e-wallet key pair including an e-wallet public key and a corresponding e-wallet private key, the e-wallet key pair being associated with the e-wallet transaction processing system; receive a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generate a public re-encryption key based on the payment gateway public key; communicate the public re-encryption key to the payment gateway system; receive or determine encrypted transaction data associated with a transaction, the encrypted transaction data including an account identifier encrypted with the e-wallet public key; re-encrypt the encrypted transaction data with the public re-encryption key; and communicate the re-encrypted transaction data to the payment gateway system. In this manner, non-limiting embodiments or aspects of the present disclosure can: (i) avoid relying on HSM processing during processing of the transaction to decrypt a PAN at the e-payment transaction processing system and / or avoid using in-memory processing to authenticate a user with the e-payment transaction processing system, which can result in faster transaction processing times (e.g., faster e-wallet checkout speeds, etc.) and decreased operational overhead, and (ii) reduce communications between the e-wallet transaction processing system and the payment gateway (e.g., avoid wallet integrations, avoid additional network inputs / outputs, etc.), which can also result in faster transaction processing times and / or faster e-wallet checkout speeds. Accordingly, non-limiting embodiments or aspects of the present disclosure can provide a more efficient and less time consuming process for authenticating a user transacting a transaction, thereby resulting in decreased checkout processing times.

[0080] Reference is now made to Figure 2 , Figure 2 is a diagram of an example environment 200 in which the apparatuses, systems, methods, and / or products described herein can be implemented. As shown, environment 200 includes a user device 202, a payment gateway 204, and an e-wallet transaction processing system 206. Figure 2As shown in FIG, environment 200 may include a user device 202, a merchant system 204, an e-wallet transaction processing system 206, a payment gateway system 208, and / or a 3D Secure provider system 210. The user device 202, the merchant system 204, the e-wallet transaction processing system 206, the payment gateway system 208, and / or the 3D Secure provider system 210 may be interconnected (e.g., connected to communicate, etc.) via a wired connection, a wireless connection, or a combination of wired and wireless connections.

[0081] The user device 202 may include one or more devices capable of receiving information and / or data from the merchant system 204, the e-wallet transaction processing system 206, the payment gateway system 208, and / or the 3D Secure provider system 210 (e.g., via the communication network 212, etc.) and / or transmitting information and / or data to the merchant system 204, the e-wallet transaction processing system 206, the payment gateway system 208, and / or the 3D Secure provider system 210 (e.g., via the communication network 212, etc.). For example, the user device 202 may include a client device, etc. In some non-limiting embodiments or aspects, the user device 202 may be capable of communicating with the merchant system 204, the e-wallet transaction processing system 206, the payment gateway system 208, and / or the 3D Secure provider system 210 via a short-range wireless communication connection (e.g., an NFC communication connection, an RFID communication connection, The user device 202 may receive information (e.g., from the merchant system 204, etc.) via a short-range wireless communication connection and / or transmit information (e.g., to the merchant system 204, etc.) via a short-range wireless communication connection. In some non-limiting embodiments or aspects, the user device 202 may include an application associated with the user device 202, such as an application stored on the user device 202, a mobile application stored and / or executed on the user device 202 (e.g., a mobile device application, a native application of the mobile device, a mobile cloud application of the mobile device, an electronic wallet application, etc.).

[0082] The merchant system 204 may include one or more devices that are capable of receiving information and / or data from the user device 202, the e-wallet transaction processing system 206, the payment gateway system 208, and / or the 3D Secure provider system 210 (e.g., via the communication network 212, etc.) and / or transmitting information and / or data to the user device 202, the e-wallet transaction processing system 206, the payment gateway system 208, and / or the 3D Secure provider system 210 (e.g., via the communication network 212, etc.). The merchant system 204 may include a device that is capable of communicating with the user device 202 via a communication connection (e.g., an NFC communication connection, an RFID communication connection, The merchant system 204 can receive information and / or data from, and / or transmit information and / or data to, the user device 202 via the communication connection and / or the like. For example, the merchant system 204 can include a computing device, such as a server, a group of servers, a client device, a group of client devices, and / or other like devices. In some non-limiting embodiments or aspects, the merchant system 204 can be associated with a merchant as described herein. In some non-limiting embodiments or aspects, the merchant system 204 can include one or more devices, such as a computer, a computer system, and / or a peripheral device, that can be used by a merchant to conduct payment transactions with a user. For example, the merchant system 204 can include a POS device and / or a POS system. In some non-limiting embodiments or aspects, the merchant system 204 can provide a merchant website via which a user can initiate and / or conduct transactions with an electronic wallet application stored and / or executed on the user device 202.

[0083] The electronic wallet transaction processing system 206 can include one or more devices that can receive information and / or data from, and / or transmit information and / or data to, the user device 202, the merchant system 204, the payment gateway system 208, and / or the 3D secure provider system 210 (e.g., via the communication network 212 and / or the like). For example, the electronic wallet transaction processing system 206 can include a computing device, such as a server (e.g., a transaction processing server and / or the like), a group of servers, and / or other like devices. In some non-limiting embodiments or aspects, the electronic wallet transaction processing system 206 can be associated with a transaction service provider and / or an electronic wallet system provider as described herein. In some non-limiting embodiments or aspects, the electronic wallet transaction processing system 206 can include and / or access one or more internal and / or external databases that include account data, PAN data, transaction data, merchant data, and / or the like.

[0084] The payment gateway system 208 can include one or more devices capable of receiving information and / or data from (e.g., via the communication network 212, etc.) the user device 202, the merchant system 204, the e-wallet transaction processing system 206, and / or the 3D secure provider system 210 and / or transmitting information and / or data to (e.g., via the communication network 212, etc.) the user device 202, the merchant system 204, the e-wallet transaction processing system 206, and / or the 3D secure provider system 210. For example, the payment gateway system 208 can include a computing device, such as a server, a group of servers, and / or other similar devices. In some non-limiting embodiments or aspects, the payment gateway system 208 is associated with a payment gateway as described herein.

[0085] The 3D secure provider system 210 can include one or more devices capable of receiving information and / or data from (e.g., via the communication network 212, etc.) the user device 202, the merchant system 204, the e-wallet transaction processing system 206, and / or the payment gateway system 208 and / or transmitting information and / or data to (e.g., via the communication network 212, etc.) the user device 202, the merchant system 204, the e-wallet transaction processing system 206, and / or the payment gateway system 208. For example, the 3D secure provider system 210 can include a computing device, such as a server, a group of servers, and / or other similar devices. In some non-limiting embodiments or aspects, the 3D secure provider system 210 can be associated with an issuer institution and / or a transaction service provider as described herein.

[0086] The communication network 212 can include one or more wired and / or wireless networks. For example, the communication network 212 can include a cellular network (e.g., a long-term evolution (LTE) network, a third generation (3G) network, a fourth generation (4G) network, a fifth generation (5G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a

[0087] The number and arrangement of devices and systems shown in Figure 2 may be provided. There can be additional devices and / or systems, fewer devices and / or systems, different devices and / or systems, and / or a different arrangement of the devices and systems than those shown in Figure 2 may be implemented within a single device and / or system, or Figure 2 two or more devices and / or systems shown inFigure 2 The individual devices and / or systems shown in FIG. 1 can be implemented as multiple distributed devices and / or systems. Additionally or alternatively, a group of devices and / or systems of environment 100 (e.g., one or more devices or systems) can perform one or more functions described as being performed by another group of devices or systems of environment 100.

[0088] Reference is now made to Figure 3 , Figure 3 is a diagram of exemplary components of a device 300. Device 300 can correspond to user device 202 (e.g., one or more devices of a system of user device 202, etc.), one or more devices of merchant system 204, one or more devices of e-wallet transaction processing system 206, one or more devices of payment gateway system 208, and / or one or more devices of 3D secure provider system 210. In some non-limiting embodiments or aspects, user device 202 (e.g., one or more devices of a system of user device 202, etc.), one or more devices of merchant system 204, one or more devices of e-wallet transaction processing system 206, one or more devices of payment gateway system 208, and / or one or more devices of 3D secure provider system 210 can include at least one device 300 and / or at least one component of device 300. As Figure 3 As shown in FIG. 1, device 300 can include bus 302, processor 304, memory 306, storage component 308, input component 310, output component 312, and communication interface 314.

[0089] Bus 302 can include a component that permits communication among the components of device 300. In some non-limiting embodiments or aspects, processor 304 can be implemented in hardware, firmware, or a combination of hardware and software. For example, processor 304 can include a processor (e.g., a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), etc.), a microprocessor, a digital signal processor (DSP), and / or any processing component that can be programmed to perform a function (e.g., a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), etc.). Memory 306 can include a random access memory (RAM), a read only memory (ROM), and / or another type of dynamic or static storage (e.g., flash memory, magnetic storage, optical storage, etc.) that stores information and / or instructions for use by processor 304.

[0090] Storage component 308 can store information and / or software related to the operation and use of device 300. For example, storage component 308 can include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, etc.), a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a cartridge, a magnetic tape, and / or another type of computer- readable medium, along with a corresponding drive.

[0091] Input component 310 can include a component that permits device 300 to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, a button, a switch, a microphone, etc.). Additionally, or alternatively, input component 310 can include a sensor (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, etc.) for sensing information. Output component 312 can include a component that provides output information from device 300 (e.g., a display, a speaker, one or more light-emitting diodes (LEDs), etc.).

[0092] Communication interface 314 can include a transceiver-like component (e.g., a transceiver, a separate receiver and transmitter, etc.) that enables device 300 to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface 314 can permit device 300 to receive information from another device and / or provide information to another device. For example, communication interface 314 can include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi® interface, a Bluetooth® interface, or the like.

[0093] Device 300 can perform one or more processes described herein. Device 300 can perform these processes based on processor 304 executing software instructions stored by a computer-readable medium, such as memory 306 and / or storage component 308. A computer-readable medium (e.g., a non-transitory computer-readable medium) is defined herein as a non-transitory memory device. A memory device includes memory space located inside of a single physical storage device or memory space spread across multiple physical storage devices.

[0094] The software instructions can be read into memory 306 and / or storage component 308 from another computer-readable medium or from another device via communication interface 314. When executed, the software instructions stored in memory 306 and / or storage component 308 can cause processor 304 to perform one or more processes described herein. Additionally, or alternatively, hardwired circuitry can be used in place of, or in combination with, software instructions to implement processes described herein. Thus, embodiments or aspects described herein are not limited to any specific combination of hardware circuitry and software.

[0095] ​Memory 306 and / or storage component 308 can include a data store or one or more data structures (e.g., a database, etc.). Device 300 can receive information from, store information in, transmit information to, or read information from the data store or one or more data structures in memory 306 and / or storage component 308. For example, e-wallet transaction processing system 206 can include and / or have access to one or more internal and / or external databases that store transaction data, account data, PAN data, transaction data, encrypted data, etc. associated with processed and / or being processed transactions.

[0096] The number and arrangement of components shown in Figure 3 may include additional components, fewer components, different components, or differently arranged components than those shown in Figure 3 Additionally or alternatively, a set of components (e.g., one or more components) of device 300 can perform one or more functions described as being performed by another set of components of device 300.

[0097] Reference is now made to Figure 4 , Figure 4 is a diagram of a non-limiting embodiment or aspect of a process 400 for authenticating a user for a transaction. In some non-limiting embodiments or aspects, one or more steps of process 400 can be performed (e.g., entirely, partially, etc.) by e-wallet transaction processing system 206 (e.g., one or more devices of e-wallet transaction processing system 206). In some non-limiting embodiments or aspects, one or more steps of process 400 can be performed (e.g., entirely, partially, etc.) by another device or group of devices independent of or including e-wallet transaction processing system 206, such as user device 202 (e.g., one or more devices of system of user device 102), merchant system 204 (e.g., one or more devices of merchant system 204), payment gateway system 208 (e.g., one or more devices of payment gateway system 208), and / or 3D secure provider system 210 (e.g., one or more devices of 3D secure provider system 210).

[0098] As Figure 4As shown in FIG. 4, at step 402, process 400 includes generating an e-wallet key pair. For example, e-wallet transaction processing system 206 can generate an e-wallet key pair. By way of example, e-wallet transaction processing system 206 can generate an e-wallet key pair that includes an e-wallet public key and a corresponding e-wallet private key. In such an example, the e-wallet key pair can be associated with e-wallet transaction processing system 206.

[0099] Referring again to Figure 5 , Figure 5 is a signal flow diagram of an implementation 500 of a non-limiting embodiment or aspect of a process for authenticating a user for a transaction. As Figure 5 shown in FIG. 5, at reference numeral 550, e-wallet transaction processing system 206 can generate an e-wallet key pair (e.g., W PK , W SK , etc.) during a key setup process, which can be an offline process and / or a process performed prior to receiving user credentials associated with an account identifier in response to a transaction being initiated and / or conducted for the user credentials.

[0100] As Figure 4 shown in FIG. 4, at step 404, process 400 includes receiving a payment gateway public key. For example, e-wallet transaction processing system 206 can receive a payment gateway public key. By way of example, e-wallet transaction processing system 206 can receive a payment gateway public key corresponding to a payment gateway private key. In such an example, the payment gateway public key and the payment gateway private key can be associated with payment gateway system 208.

[0101] Referring again to Figure 5 , at reference numeral 552, payment gateway 208 can generate a payment gateway key pair (e.g., PG PK , PG SK , etc.) during a key setup process, which includes a payment gateway public key (e.g., PG SK , etc.) corresponding to a payment gateway private key (e.g., PG PK , etc.). At reference numeral 554, payment gateway 208 can communicate the payment gateway public key to e-wallet transaction processing system 206. For example, e-wallet transaction processing system 206 can receive the payment gateway public key from payment gateway 208 during the key setup process.

[0102] As Figure 4As shown in FIG. 4, at step 406, process 400 includes generating a public re-encryption key based on the payment gateway public key. For example, electronic wallet transaction processing system 206 can generate a public re-encryption key based on the payment gateway public key. By way of illustration, electronic wallet transaction processing system 206 can generate a public re-encryption key based on the payment gateway public key received from payment gateway system 208.

[0103] In some non-limiting embodiments or aspects, electronic wallet transaction processing system 206 can generate a public re-encryption key based on a public key as described by Ateniese, G., Fu, K., Green, M., Hohenberger, S. in a paper entitled "Improved Proxy Re-encryption Schemes with Applications to Secure Distributed Storage," pp. 29-43, in Proceedings of the 12th Annual Network and Distributed System Security Symposium (2005), the entirety of which is incorporated by reference herein. For example, and with further reference to Figure 5 As shown in FIG. 5, at reference numeral 556, electronic wallet transaction processing system 206 can generate a public re-encryption key (e.g., RK PK , etc.) using the payment gateway public key (e.g., PG W->PGpk , etc.) received from payment gateway 208 during the key setup process.

[0104] As shown in FIG. 4, at step 408, process 400 includes communicating the public re-encryption key to the payment gateway system. For example, electronic wallet transaction processing system 206 can communicate the public re-encryption key to payment gateway system 208. By way of illustration, electronic wallet transaction processing system 206 can communicate the public re-encryption key to payment gateway system 208. In such an example, and with further reference to Figure 5 As shown in FIG. 5, at reference numeral 556, electronic wallet transaction processing system 206 can generate a public re-encryption key (e.g., RK W->PGpk , etc.) using the payment gateway public key (e.g., PG W->PGpk , etc.) received from payment gateway 208 during the key setup process. At reference numeral 560, payment gateway system 208 (and / or electronic wallet transaction processing system 206, etc.) can communicate the public re-encryption key (e.g., RK W->PGpk , etc.) to merchant system 204.

[0105] As shown in FIG. 4, at step 408, process 400 includes communicating the public re-encryption key to the payment gateway system. For example, electronic wallet transaction processing system 206 can communicate the public re-encryption key to payment gateway system 208. By way of illustration, electronic wallet transaction processing system 206 can communicate the public re-encryption key to payment gateway system 208. In such an example, and with further reference to Figure 4As shown in , at step 410, process 400 includes receiving user credentials of a user. For example, the electronic wallet transaction processing system 206 can receive the user credentials of the user. For example, the electronic wallet transaction processing system 206 can receive the user credentials associated with the user who is transacting.

[0106] In some non-limiting embodiments or aspects, the e-wallet transaction processing system 206 receives user credentials associated with the user with whom the transaction occurred from the merchant system 204. For example, and also with reference to Figure 6 , Figure 6 FIG. 6 is a signal flow diagram of an embodiment 600 of a non-limiting embodiment or aspect of a process for authenticating a user conducting a transaction. Figure 6 As shown in FIG, at reference numeral 650, the merchant system 204 can receive user credentials, such as a username and password, from the user device 202 for initiating or conducting a transaction at the merchant system 204, and transmit the user credentials to the e-wallet transaction processing system 206 at reference numeral 652, which can be encrypted using a public re-encryption key (e.g., RK W->PGpk The user credentials are encrypted.

[0107] like Figure 4 As shown in , at step 412, process 400 includes receiving or determining encrypted transaction data associated with the transaction. For example, the e-wallet transaction processing system 206 can receive or determine encrypted transaction data associated with the transaction. For example, the e-wallet transaction processing system 206 can receive or determine encrypted transaction data associated with the transaction. In this example, the encrypted transaction data can include an account identifier (e.g., PAN, etc.) encrypted using the e-wallet public key.

[0108] In some non-limiting embodiments or aspects, the transaction data includes transaction parameters associated with a transaction, such as a payment transaction initiated and / or conducted with the e-wallet application, etc. Non-limiting examples of transaction parameters include: e-wallet card data, decision data, authorization data, an account identifier (e.g., a PAN, etc.), a transaction amount, a transaction date and time, a currency exchange rate, a merchant type, an acquirer country, a PAN country, a response code, a merchant name / location, a currency type, etc. The response code can refer to a successful approval / completion of a transaction, a denial due to a card being reported lost or stolen, a dishonored, a partial approval, a VIP approval (a VIP program), an amount exceeding a maximum, a lack of funds, an incorrect PIN, suspected fraud, an exceeded activity volume, an exceeded number of allowable PIN entry attempts, etc. In some non-limiting embodiments or aspects, the e-wallet card data includes one or more of the following data: data associated with an identifier for a portable financial device to be provisioned to the e-wallet application; data associated with an identifier for an issuer associated with a portable financial device to be provisioned to the e-wallet application; data associated with an identifier for a transaction service provider associated with a portable financial device to be provisioned to the e-wallet application; data associated with a name for a user associated with a portable financial device to be provisioned to the e-wallet application; data associated with an account identifier for an account associated with a portable financial device to be provisioned to the e-wallet application; etc.

[0109] In some non-limiting embodiments or aspects, the e-wallet transaction processing system 206 can store account identifiers associated with user credentials encrypted with the e-wallet public key in an in-memory database. For example, the e-wallet transaction processing system 206 can encrypt and store account identifiers (e.g., PANs, etc.) associated with registered users or accounts having user credentials (e.g., usernames, passwords, etc.) in an in-memory database to facilitate faster access during processing of transactions. By way of example, and with reference again to Figure 5 At reference numeral 562, the e-wallet transaction processing system 206 can encrypt and store account identifiers using the wallet public key (e.g., W PK In this example, and with reference again to Figure 6 At reference numeral 654, the e-wallet transaction processing system 206 can identify or determine an account identifier associated with a user for which a transaction occurred based on a user credential associated with the user without decrypting the encrypted transaction data including the account identifier encrypted with the e-wallet public key. For example, the e-wallet transaction processing system 206 can look up or determine an account identifier associated with a user credential in the in-memory database using a user credential associated with the user.

[0110] AsFigure 4 As shown in , at step 414, process 400 includes authenticating the user who is transacting based on the user credentials. For example, the electronic wallet transaction processing system 206 can authenticate the user who is transacting based on the user credentials. For example, the electronic wallet transaction processing system 206 can authenticate the user who is transacting based on the user credentials received from the merchant system 204. In this example, authenticating the user who is transacting can include re-encrypting the encrypted transaction data using a public re-encryption key and transmitting the re-encrypted transaction data to the payment gateway system 208, as described herein with respect to Figure 4 Steps 416 and 418 are described in more detail.

[0111] like Figure 4 As shown in , at step 416, process 400 includes re-encrypting the encrypted transaction data using the public re-encryption key. For example, the electronic wallet transaction processing system 206 can re-encrypt the encrypted transaction data using the public re-encryption key. For example, the electronic wallet transaction processing system 206 can re-encrypt the encrypted transaction data using the public re-encryption key. In this example, and again referring to Figure 6 At reference numeral 656, authenticating the user who is transacting may include: utilizing a public re-encryption key (e.g., Re-Enc(RK W->PGpk ,Enc(W PK , PAN))) re-encrypts the encrypted transaction data (such as PAN) and transmits the re-encrypted transaction data to the payment gateway system 208. For example, it is represented as Re-Enc(RK W->PGpk ,Enc(W PK , PAN)) can be referred to as a ReToken. Therefore, non-limiting embodiments or aspects of the present disclosure can avoid relying on HSM processing during transaction processing for decrypting the PAN at the electronic payment transaction processing system 206 by using in-memory processing for authenticating the user and the ReToken including the encrypted PAN at the electronic payment transaction processing system 206 (e.g., without decrypting the encrypted PAN, etc.), which results in faster transaction processing times (e.g., faster e-wallet checkout, etc.) and reduced operational overhead.

[0112] like Figure 4At step 418, process 400 includes transmitting the re-encrypted transaction data to a payment gateway system, as shown in FIG. 4. For example, e-wallet transaction processing system 206 can transmit the re-encrypted transaction data to payment gateway system 208. By way of illustration, e-wallet transaction processing system 206 can transmit the re-encrypted transaction data to payment gateway system 208. In this example, and with reference again to Figure 6 At reference numeral 658, e-wallet transaction processing system 206 can transmit the ReToken to payment gateway 208. Accordingly, non-limiting embodiments or aspects of the present disclosure can break the data flow loop between transaction processing system 206 and payment gateway 208, and reduce the communication between e-wallet transaction processing system 206 and payment gateway 208 used to authenticate a user making a transaction, which can result in faster transaction processing times and / or faster e-wallet checkout.

[0113] In some non-limiting embodiments or aspects, e-wallet transaction processing system 206 transmits the re-encrypted transaction data to payment gateway system 208 via merchant system 204. For example, and with reference again to Figure 6 At reference numeral 658, e-wallet transaction processing system 206 transmits the ReToken to payment gateway system 208 via merchant system 204, which forwards the ReToken received from e-wallet transaction processing system 206 to payment gateway system 208 at reference numeral 660.

[0114] In some non-limiting embodiments or aspects, payment gateway system 208 can receive the re-encrypted transaction data, decrypt the re-encrypted transaction data based on a payment gateway secret key, and identify the account identifier. For example, and with reference again to Figure 6 At reference numeral 662, payment gateway system 208 can use a secret key (e.g., payment gateway secret key PGSK) as described by Ateniese, G., Fu, K., Green, M., Hohenberger, S. in “Improved Proxy Re-encryption Schemes with Applications to Secure Distributed Storage,” pp. 29-43, in Proceedings of the 12th Annual Network and Distributed System Security Symposium (2005) to decrypt the re-encrypted transaction data, as shown in FIG. 6. Accordingly, non-limiting embodiments or aspects of the present disclosure can break the data flow loop between transaction processing system 206 and payment gateway 208, and reduce the communication between e-wallet transaction processing system 206 and payment gateway 208 used to authenticate a user making a transaction, which can result in faster transaction processing times and / or faster e-wallet checkout. SKFor example, decrypting the ReToken may provide or identify the actual or unencrypted PAN and / or PAN data associated therewith to the payment gateway system 208.

[0115] In some non-limiting embodiments or aspects, and still with reference to Figure 6 , at reference numeral 664, the payment gateway 208 may transmit the account identifier (e.g., PAN, BIN of PAN, etc.) to the 3D Secure provider system 210 to further authenticate the user and / or authorize the transaction with an additional layer of security that helps inhibit or prevent unauthorized CNP transactions (card not present transactions) and protect merchants from CNP fraud.

[0116] Although embodiments or aspects have been described in detail for purposes of illustration and description, it will be understood that such detail is intended for that purpose only, and that the embodiments or aspects are not limited to the disclosed embodiments or aspects, but, on the contrary, are intended to cover modifications and equivalent arrangements within the spirit and scope of the appended claims. For example, it will be understood that the present disclosure contemplates that, to the extent possible, one or more features of any embodiment or aspect may be combined with one or more features of any other embodiment or aspect. Indeed, any of these features may be combined in manners not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may be directly dependent on only one claim, the disclosure of possible implementations includes each dependent claim in combination with every other claim in the claim set.

Claims

1. A computer-implemented method comprising: generating an electronic wallet key pair using an electronic wallet transaction processing system, the electronic wallet key pair comprising an electronic wallet public key and a corresponding electronic wallet private key, the electronic wallet key pair being associated with the electronic wallet transaction processing system; Receiving, using the electronic wallet transaction processing system, a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; generating a public re-encryption key based on the payment gateway public key using the electronic wallet transaction processing system; transmitting the public re-encryption key from the electronic wallet transaction processing system to the payment gateway system; receiving or determining, using the electronic wallet transaction processing system, encrypted transaction data associated with a transaction, the encrypted transaction data including an account identifier obtained from an in-memory database and encrypted using the electronic wallet public key; re-encrypting the encrypted transaction data using the public re-encryption key using the electronic wallet transaction processing system; as well as transmitting the re-encrypted transaction data from the electronic wallet transaction processing system to the payment gateway system; The receiving or determining encrypted transaction data associated with the transaction using the electronic wallet transaction processing system comprises: receiving, using the electronic wallet transaction processing system, user credentials associated with a user who is conducting the transaction; An account identifier associated with the user is identified or determined using the user credentials, wherein the account identifier is associated with the user credentials and pre-stored in the memory database after being encrypted by the electronic wallet public key.

2. The computer-implemented method of claim 1 , further comprising: The electronic wallet transaction processing system is used to verify the user who conducts the transaction based on the user credentials, wherein verifying the user who conducts the transaction includes: using the public re-encryption key to re-encrypt the encrypted transaction data, and transmitting the re-encrypted transaction data to the payment gateway system.

3. The computer-implemented method of claim 2 , wherein the e-wallet transaction processing system authenticates the user with whom the transaction occurred based on the user credentials without decrypting the encrypted transaction data including the account identifier encrypted using the e-wallet public key.

4. The computer-implemented method of claim 2, further comprising: The account identifier associated with the user credentials, encrypted using the e-wallet public key, is stored in an in-memory database using the e-wallet transaction processing system.

5. The computer-implemented method of claim 2, wherein the e-wallet transaction processing system transmits the heavily encrypted transaction data to the payment gateway system via a merchant system.

6. The computer-implemented method of claim 5, wherein the e-Wallet transaction processing system receives the user credentials associated with the user with whom the transaction occurred from the merchant system.

7. The computer-implemented method of claim 1 , further comprising: Receiving the re-encrypted transaction data using the payment gateway system; decrypting, using the payment gateway system, the re-encrypted transaction data based at least in part on the payment gateway private key; as well as The account identifier is identified using the payment gateway.

8. A system comprising: An electronic wallet transaction processing system, the electronic wallet transaction processing system comprising one or more processors programmed and / or configured to: generating an e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, wherein the e-wallet key pair is associated with the e-wallet transaction processing system; receiving a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; Generate a public re-encryption key based on the payment gateway public key; transmitting the public re-encryption key to the payment gateway system; receiving or determining encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier obtained from an in-memory database and encrypted using the electronic wallet public key; re-encrypting the encrypted transaction data using the public re-encryption key; as well as transmitting the re-encrypted transaction data to the payment gateway system; The receiving or determining encrypted transaction data associated with the transaction comprises: receiving user credentials associated with a user who is engaging in the transaction; An account identifier associated with the user is identified or determined using the user credentials, wherein the account identifier is associated with the user credentials and pre-stored in the memory database after being encrypted by the electronic wallet public key.

9. The system of claim 8, wherein the electronic wallet transaction processing system including the one or more processors is further programmed and / or configured to: Verifying the user who has conducted the transaction based on the user credentials, wherein verifying the user who has conducted the transaction includes: The encrypted transaction data is re-encrypted using the public re-encryption key, and the re-encrypted transaction data is transmitted to the payment gateway system.

10. The system of claim 9, wherein the e-wallet transaction processing system including the one or more processors authenticates the user with whom the transaction occurred based on the user credentials without decrypting the encrypted transaction data including the account identifier encrypted using the e-wallet public key.

11. The system of claim 9, wherein the electronic wallet transaction processing system including the one or more processors is further programmed and / or configured to: The account identifier associated with the user credentials is stored in an in-memory database, encrypted using the e-wallet public key.

12. The system of claim 9, wherein the e-wallet transaction processing system including the one or more processors transmits the heavily encrypted transaction data to the payment gateway system via a merchant system.

13. The system of claim 12, wherein the e-wallet transaction processing system including the one or more processors receives the user credentials associated with the user conducting the transaction from the merchant system.

14. The system of claim 8, further comprising: The payment gateway system includes one or more processors programmed and / or configured to: receiving the re-encrypted transaction data; decrypting the re-encrypted transaction data based at least in part on the payment gateway private key; and Identify the account identifier.

15. A computer program product comprising at least one non-transitory computer-readable medium containing program instructions that, when executed by at least one processor, cause the at least one processor to: generating an e-wallet key pair comprising an e-wallet public key and a corresponding e-wallet private key, wherein the e-wallet key pair is associated with the e-wallet transaction processing system; receiving a payment gateway public key corresponding to a payment gateway private key, the payment gateway public key and the payment gateway private key being associated with a payment gateway system; Generate a public re-encryption key based on the payment gateway public key; transmitting the public re-encryption key to the payment gateway system; receiving or determining encrypted transaction data associated with a transaction, the encrypted transaction data comprising an account identifier obtained from an in-memory database and encrypted using the electronic wallet public key; re-encrypting the encrypted transaction data using the public re-encryption key; as well as transmitting the re-encrypted transaction data to the payment gateway system; The receiving or determining encrypted transaction data associated with the transaction comprises: receiving user credentials associated with a user who is engaging in the transaction; An account identifier associated with the user is identified or determined using the user credentials, wherein the account identifier is associated with the user credentials and pre-stored in the memory database after being encrypted by the electronic wallet public key.

16. The computer program product of claim 15, wherein the instructions further cause the at least one processor to: Verifying the user who has conducted the transaction based on the user credentials, wherein verifying the user who has conducted the transaction includes: The encrypted transaction data is re-encrypted using the public re-encryption key, and the re-encrypted transaction data is transmitted to the payment gateway system.

17. The computer program product of claim 16, wherein the instructions cause the at least one processor to authenticate the user with whom the transaction occurred based on the user credentials without decrypting the encrypted transaction data including the account identifier encrypted using the e-wallet public key.

18. The computer program product of claim 16, wherein the instructions further cause the at least one processor to: The account identifier associated with the user credentials is stored in an in-memory database, encrypted using the e-wallet public key.

19. The computer program product of claim 16, wherein the instructions cause the at least one processor to: transmitting the re-encrypted transaction data to the payment gateway system via the merchant system; and The user credentials associated with the user with whom the transaction occurred are received from the merchant system.

20. The computer program product of claim 15, wherein the instructions further cause the at least one processor to: receiving the re-encrypted transaction data; decrypting the re-encrypted transaction data based at least in part on the payment gateway private key; and Identify the account identifier.

Images