# US 12,015,716 B2 · System and method for securely processing an electronic identity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,716 B2
- Document ID: US12015716B2
- Status: Granted
- Kind: B2
- Application number: 17/379,687
- Filed: 2021-07-19
- Published: 2021-11-11
- Granted: 2024-06-18
- Earliest claimed: 2021-07-19
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: Quan Wang
- Web page: https://patentgrep.com/patent/US12015716B2

## CPC

- H04L 9/3236: {using cryptographic hash functions}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/06: the encryption apparatus using shift registers or memories for block-wise {or stream} coding, e.g. DES systems {or RC4; Hash functions; Pseudorandom sequence generators}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2463/102: applying security measure for e-commerce
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method for providing identification using an endpoint device is disclosed. The endpoint device may include an electronic identity that is unique and can be securely stored. The electronic identity may be passed to an access device along with signed interaction data and a cryptogram. The access device may generate an authorization request with the cryptogram and may send it to a remote server computer for further processing.

## Claims

### Claim 1

A server computer configured to process an electronic identity of a user, the server computer comprising:
a network interface;
a processor; and
a non-transitory computer-readable medium comprising code for instructing the processor to implement a method including:
receiving, from an access device, an authorization request message comprising a cryptogram and a dynamic set of data, wherein the cryptogram comprises an interaction record comprising interaction data encrypted using a limited-use key associated with limited-use parameters, the interaction record being signed by a private key of the user and a private key of a resource provider, wherein the cryptogram further comprises the electronic identity of the user, the electronic identity being derived based on information associated with the user;
determining, based on the dynamic set of data, a symmetric limited-use key corresponding to the limited-use key;
decrypting the cryptogram using the symmetric limited-use key;
validating the limited-use parameters associated with the limited-use key;
validating the electronic identity of the user; and
in response to the electronic identity and the limited-use parameters being validated, approving the authorization request message or forwarding the authorization request message to an authorizing entity computer,
wherein the interaction record further comprises an interaction stamp.

### Claim 2 (depends on 1)

The server computer of claim 1, wherein the electronic identity is also encrypted.

### Claim 3 (depends on 1)

The server computer of claim 1, wherein validating the electronic identity includes querying a blockchain for the electronic identity.

### Claim 4 (depends on 1)

The server computer of claim 1, wherein the electronic identity is a hash of information associated with the user.

### Claim 5 (depends on 1)

The server computer of claim 1, wherein the cryptogram encodes at least an amount, an unpredictable number, and an application transaction counter.

### Claim 6 (depends on 1)

The server computer of claim 1, wherein the method further includes:
generating a risk score based on an electronic record based upon the electronic identity and data from nodes in a distributed verification network.

### Claim 7 (depends on 1)

The server computer of claim 1, wherein the dynamic set of data is clear text data that comprises a key index and accompanies the cryptogram in the authorization request message.

### Claim 8 (depends on 1)

The server computer of claim 1, wherein the authorization request message is an ISO 8583 message.

### Claim 9

A method comprising:
receiving, from an access device by a server computer, an authorization request message comprising a cryptogram and a dynamic set of data, wherein the cryptogram comprises an interaction record comprising interaction data encrypted using a limited-use key associated with limited-use parameters, the interaction record being signed by a private key of a user and a private key of a resource provider, wherein the cryptogram further comprises an electronic identity of the user, the electronic identity being derived based on information associated with the user;
determining, based on the dynamic set of data, a symmetric limited-use key corresponding to the limited-use key;
decrypting the cryptogram using the symmetric limited-use key;
validating the limited-use parameters associated with the limited-use key;
validating the electronic identity of the user; and
in response to the electronic identity and the limited-use parameters being validated, approving the authorization request message or forwarding the authorization request message to an authorizing entity computer,
wherein the interaction record further comprises an interaction stamp.

### Claim 10 (depends on 9)

The method of claim 9, wherein the electronic identity is also encrypted.

### Claim 11 (depends on 9)

The method of claim 9, wherein the dynamic set of data comprises the limited-use key.

### Claim 12 (depends on 9)

The method of claim 9, wherein the electronic identity is a hash of the information associated with the user.

### Claim 13 (depends on 9)

The method of claim 9, wherein the cryptogram encodes at least an amount, an unpredictable number, and an application transaction counter.

### Claim 14 (depends on 9)

The method of claim 9, wherein the method further comprises:
generating a risk score based on an electronic record based upon the electronic identity and data from nodes in a distributed verification network.

### Claim 15 (depends on 9)

The method of claim 9, wherein the access device interacts with an endpoint device before the authorization request message is received from the access device.

### Claim 16 (depends on 9)

The method of claim 9, wherein the cryptogram comprises a key index.