# US 10,769,626 B2 · Method and system for distribution, use and validation of electronic entitlement certificates

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,626 B2
- Document ID: US10769626B2
- Status: Granted
- Kind: B2
- Application number: 15/380,577
- Filed: 2016-12-15
- Published: 2017-06-22
- Granted: 2020-09-08
- Earliest claimed: 2015-12-17
- Assignees: Mastercard International Incorporated
- Applicants: Mastercard International Incorporated
- Inventors: Pablo Fourez; Alan Johnson
- Web page: https://patentgrep.com/patent/US10769626B2

## CPC

- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- G06F 16/22: Indexing; Data structures therefor; Storage structures
- G06F 16/2455: Query execution
- G06Q 20/38: Payment protocols; Details thereof
- G06Q 20/3829: {involving key management}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for distribution and transfer of entitlement certificates includes: storing account profiles, each account including an account identifier, primary account number, and account balance; receiving an entitlement request from a computing device including a specific account identifier, entitlement balance, and usage controls; identifying a specific account profile that includes the specific account identifier; generating an entitlement certificate that includes the entitlement balance and usage controls; generating an entitlement identifier for the entitlement certificate; placing a hold associated with the entitlement certificate on the account balance included in the specific account profile for the entitlement balance; and transmitting the entitlement certificate to the computing device.

## Claims

### Claim 1

A method for distribution and transfer of entitlement certificates, comprising:
electronically issuing, by an issuer server, respective payment credentials to a plurality of computing devices of consumers, wherein said payment credentials are associated with respective transaction accounts;
storing, in an account database of an issuer server, a plurality of account profiles, wherein each account profile includes at least an account identifier, a primary account number of an associated transaction account, an account balance of the associated transaction account, and a public key of an associated computing device;
receiving, by a receiving device of the issuer server, a data signal superimposed with an entitlement request from a computing device of a consumer, from the plurality of computing devices, via a communication network, wherein the entitlement request includes at least a specific account identifier, entitlement balance, and one or more usage controls;
executing, by a querying module of the issuer server, a first query on the account database and identifying a specific account profile where the account identifier included in the specific account profile corresponds to the specific account identifier included in the received entitlement request;
generating, by a generation module of the issuer server, an entitlement certificate based on at least the entitlement balance and the one or more usage controls included in the received entitlement request;
generating, by a generation module of the issuer server, an entitlement identifier by applying at least one hashing algorithm to the generated entitlement certificate;
executing, by the querying module of the issuer server, a second query on the account database and, in response to said executed query, (i) placing a hold associated with the entitlement certificate on the account balance of the associated transaction account included in the specific account profile for at least the entitlement balance, and (ii) inserting the generated entitlement identifier into the specific account profile;
electronically transmitting, by a transmitting device of the issuer server, via the communication network, a data signal superimposed with the entitlement certificate to the computing device of the consumer;
receiving, by the issuer server, from a payment network via payment rails associated with the payment network, a digitally signed entitlement certificate for transfer of funds associated with the entitlement balance, and
validating, by a validation module of the issuer server, the digitally signed entitlement certificate using a public key of the computing device of the consumer stored in the database.

### Claim 2 (depends on 1)

The method of claim 1, wherein
the receiving, by the issuer server, of the entitlement certificate from the payment network includes receiving a transaction message, wherein the transaction message is formatted based on one or more standards and includes at least a message type indicator indicative of a clearing record, a first data element configured to store the primary account number included in the specific account profile, and a second data element configured to store the generated entitlement identifier; and
executing, by the querying module of the processing server, a third query on the account profile to release the hold associated with the entitlement certificate on the account balance.

### Claim 3 (depends on 1)

The method of claim 1, wherein
the transmitting, by the issuer server, of the generated entitlement certificate, includes transmitting the entitlement certificate to the computing device, via a secondary device in communication with the computing device.

### Claim 4

A system for distribution and transfer of entitlement certificates, comprising:
a transmitting device of an issuer server configured to issue respective payment credentials to a plurality of computing devices of consumers, wherein said payment credentials are associated with respective transaction accounts;
an account database of the issuer server configured to store a plurality of account profiles, wherein each account profile includes at least an account identifier, a primary account number of an associated transaction account, an account balance of the associated transaction account, and a public key of an associated computing device;
a receiving device of the issuer server configured to receive a data signal superimposed with an entitlement request from a computing device of a consumer, from the plurality of computing devices, via communication network, wherein the entitlement request includes at least a specific account identifier, entitlement balance, and one or more usage controls;
a querying module of the issuer server configured to execute a first query on the account database and identify a specific account profile where the account identifier included in the specific account profile corresponds to the specific account identifier included in the received entitlement request;
a generation module of the issuer server configured to generate
an entitlement certificate based on at least the entitlement balance and the one or more usage controls included in the received entitlement request, and
an entitlement identifier for the generated entitlement certificate by applying at least one hashing algorithm to the generated entitlement certificate, and
a validation module of the issuer server,
wherein
the querying module of the issuer server is further configured to execute a second query on the account database and, in response to said executed query, the issuer server (i) places a hold associated with the entitlement certificate on the account balance included in the specific account profile for at least the entitlement balance, and (ii) inserts the generated entitlement identifier into the specific account profile,
the transmitting device of the issuer server is further configured to electronically transmit, via the communication network, a data signal superimposed with the entitlement certificate to the computing device of the consumer,
the receiving device of the issuer server is further configured to receive, from a payment network, via payment rails associated with the payment network, a digitally signed entitlement certificate for transfer of funds associated with the entitlement balance, and
the validation module of the issuer server is configured to validate the digitally signed entitlement certificate using a public key of the computing of the consumer stored in the database.

### Claim 5 (depends on 4)

The system of claim 4, wherein
the receiving device of the processing server is further configured to receive, along with the entitlement certificate received from the payment network, a transaction message from the payment network, wherein the transaction message is formatted based on one or more standards and includes at least a message type indicator indicative of a clearing record, a first data element configured to store the primary account number included in the specific account profile, and a second data element configured to store the generated entitlement identifier, and
the querying module of the processing server is further configured to execute a third query on the account profile to release the hold associated with the entitlement certificate on the account balance.

### Claim 6 (depends on 4)

The system of claim 4, wherein
the issuer transmits the entitlement certificate to the computing device via a secondary computing device in communication with the computing device.